Analysis
- max time kernel
148s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe
- Size 60KB
- Sample240613-ejyfpatdjc
- SHA256 98055bb587e60853aa248c3f236875444d92a6d2d76120d04a8b89b3e0125319
- MD5 5c9799fbc1eb579e502e343c4b601e60
- SHA1 d79a0b1cdc6f4d0244dc0c52335a211dc04dc214
- SHA512 5d018cba3898d9ed7fb6f762342c809ea5221253324319056eff086040f39a941b9bb784ca34421149aaba30fd5e6fe71d3f16ca5b70b7cf82da4c961ade5326
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroy4/CFsrdHWMZo:vvw9816vhKQLroy4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFD7FBA9-1F97-4106-829B-60D78048C35A}\stubpath = "C:\\Windows\\{AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe" {6282681E-BD07-4fa8-A234-514DC17261B8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A95A082B-CFE7-4313-B913-807B6285602F}\stubpath = "C:\\Windows\\{A95A082B-CFE7-4313-B913-807B6285602F}.exe" {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15719FE1-7CAA-416d-A364-4011D2733F88} {A95A082B-CFE7-4313-B913-807B6285602F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D4292F5-B846-4127-B4A4-5D68C403C0D7} {E87A6574-CB28-424e-AF9D-99382AE1C824}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4D4292F5-B846-4127-B4A4-5D68C403C0D7}\stubpath = "C:\\Windows\\{4D4292F5-B846-4127-B4A4-5D68C403C0D7}.exe" {E87A6574-CB28-424e-AF9D-99382AE1C824}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6E356DB-BA0E-4894-B7C2-E3E3D492BE8A} {4D4292F5-B846-4127-B4A4-5D68C403C0D7}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AFD7FBA9-1F97-4106-829B-60D78048C35A} {6282681E-BD07-4fa8-A234-514DC17261B8}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}\stubpath = "C:\\Windows\\{1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe" {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EDACD8E-86B7-4571-A606-5ADD0CAAB67C} {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}\stubpath = "C:\\Windows\\{8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe" {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60C76FFD-F143-4714-BF5A-2309C859C948}\stubpath = "C:\\Windows\\{60C76FFD-F143-4714-BF5A-2309C859C948}.exe" {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}\stubpath = "C:\\Windows\\{B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe" {60C76FFD-F143-4714-BF5A-2309C859C948}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC} {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01} {60C76FFD-F143-4714-BF5A-2309C859C948}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A95A082B-CFE7-4313-B913-807B6285602F} {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E87A6574-CB28-424e-AF9D-99382AE1C824} {15719FE1-7CAA-416d-A364-4011D2733F88}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5454831-6705-4e6a-BB31-0CE830F7D917} 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6282681E-BD07-4fa8-A234-514DC17261B8} {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6282681E-BD07-4fa8-A234-514DC17261B8}\stubpath = "C:\\Windows\\{6282681E-BD07-4fa8-A234-514DC17261B8}.exe" {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60C76FFD-F143-4714-BF5A-2309C859C948} {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15719FE1-7CAA-416d-A364-4011D2733F88}\stubpath = "C:\\Windows\\{15719FE1-7CAA-416d-A364-4011D2733F88}.exe" {A95A082B-CFE7-4313-B913-807B6285602F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E87A6574-CB28-424e-AF9D-99382AE1C824}\stubpath = "C:\\Windows\\{E87A6574-CB28-424e-AF9D-99382AE1C824}.exe" {15719FE1-7CAA-416d-A364-4011D2733F88}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6E356DB-BA0E-4894-B7C2-E3E3D492BE8A}\stubpath = "C:\\Windows\\{B6E356DB-BA0E-4894-B7C2-E3E3D492BE8A}.exe" {4D4292F5-B846-4127-B4A4-5D68C403C0D7}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5454831-6705-4e6a-BB31-0CE830F7D917}\stubpath = "C:\\Windows\\{F5454831-6705-4e6a-BB31-0CE830F7D917}.exe" 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe - Executes dropped EXE 12 IoCs
pid Process 3924 {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe 3784 {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe 2172 {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe 3432 {6282681E-BD07-4fa8-A234-514DC17261B8}.exe 4764 {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe 4540 {60C76FFD-F143-4714-BF5A-2309C859C948}.exe 3576 {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe 2004 {A95A082B-CFE7-4313-B913-807B6285602F}.exe 4284 {15719FE1-7CAA-416d-A364-4011D2733F88}.exe 3348 {E87A6574-CB28-424e-AF9D-99382AE1C824}.exe 332 {4D4292F5-B846-4127-B4A4-5D68C403C0D7}.exe 4596 {B6E356DB-BA0E-4894-B7C2-E3E3D492BE8A}.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{F5454831-6705-4e6a-BB31-0CE830F7D917}.exe 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe File created C:\Windows\{8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe File created C:\Windows\{6282681E-BD07-4fa8-A234-514DC17261B8}.exe {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe File created C:\Windows\{AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe {6282681E-BD07-4fa8-A234-514DC17261B8}.exe File created C:\Windows\{60C76FFD-F143-4714-BF5A-2309C859C948}.exe {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe File created C:\Windows\{4D4292F5-B846-4127-B4A4-5D68C403C0D7}.exe {E87A6574-CB28-424e-AF9D-99382AE1C824}.exe File created C:\Windows\{1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe File created C:\Windows\{B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe {60C76FFD-F143-4714-BF5A-2309C859C948}.exe File created C:\Windows\{A95A082B-CFE7-4313-B913-807B6285602F}.exe {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe File created C:\Windows\{15719FE1-7CAA-416d-A364-4011D2733F88}.exe {A95A082B-CFE7-4313-B913-807B6285602F}.exe File created C:\Windows\{E87A6574-CB28-424e-AF9D-99382AE1C824}.exe {15719FE1-7CAA-416d-A364-4011D2733F88}.exe File created C:\Windows\{B6E356DB-BA0E-4894-B7C2-E3E3D492BE8A}.exe {4D4292F5-B846-4127-B4A4-5D68C403C0D7}.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 372 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe Token: SeIncBasePriorityPrivilege 3924 {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe Token: SeIncBasePriorityPrivilege 3784 {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe Token: SeIncBasePriorityPrivilege 2172 {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe Token: SeIncBasePriorityPrivilege 3432 {6282681E-BD07-4fa8-A234-514DC17261B8}.exe Token: SeIncBasePriorityPrivilege 4764 {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe Token: SeIncBasePriorityPrivilege 4540 {60C76FFD-F143-4714-BF5A-2309C859C948}.exe Token: SeIncBasePriorityPrivilege 3576 {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe Token: SeIncBasePriorityPrivilege 2004 {A95A082B-CFE7-4313-B913-807B6285602F}.exe Token: SeIncBasePriorityPrivilege 4284 {15719FE1-7CAA-416d-A364-4011D2733F88}.exe Token: SeIncBasePriorityPrivilege 3348 {E87A6574-CB28-424e-AF9D-99382AE1C824}.exe Token: SeIncBasePriorityPrivilege 332 {4D4292F5-B846-4127-B4A4-5D68C403C0D7}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 3924 372 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe 95 PID 372 wrote to memory of 3924 372 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe 95 PID 372 wrote to memory of 3924 372 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe 95 PID 372 wrote to memory of 4084 372 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe 96 PID 372 wrote to memory of 4084 372 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe 96 PID 372 wrote to memory of 4084 372 5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe 96 PID 3924 wrote to memory of 3784 3924 {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe 100 PID 3924 wrote to memory of 3784 3924 {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe 100 PID 3924 wrote to memory of 3784 3924 {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe 100 PID 3924 wrote to memory of 4452 3924 {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe 101 PID 3924 wrote to memory of 4452 3924 {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe 101 PID 3924 wrote to memory of 4452 3924 {F5454831-6705-4e6a-BB31-0CE830F7D917}.exe 101 PID 3784 wrote to memory of 2172 3784 {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe 103 PID 3784 wrote to memory of 2172 3784 {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe 103 PID 3784 wrote to memory of 2172 3784 {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe 103 PID 3784 wrote to memory of 3184 3784 {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe 104 PID 3784 wrote to memory of 3184 3784 {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe 104 PID 3784 wrote to memory of 3184 3784 {1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe 104 PID 2172 wrote to memory of 3432 2172 {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe 106 PID 2172 wrote to memory of 3432 2172 {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe 106 PID 2172 wrote to memory of 3432 2172 {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe 106 PID 2172 wrote to memory of 4668 2172 {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe 107 PID 2172 wrote to memory of 4668 2172 {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe 107 PID 2172 wrote to memory of 4668 2172 {8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe 107 PID 3432 wrote to memory of 4764 3432 {6282681E-BD07-4fa8-A234-514DC17261B8}.exe 108 PID 3432 wrote to memory of 4764 3432 {6282681E-BD07-4fa8-A234-514DC17261B8}.exe 108 PID 3432 wrote to memory of 4764 3432 {6282681E-BD07-4fa8-A234-514DC17261B8}.exe 108 PID 3432 wrote to memory of 4912 3432 {6282681E-BD07-4fa8-A234-514DC17261B8}.exe 109 PID 3432 wrote to memory of 4912 3432 {6282681E-BD07-4fa8-A234-514DC17261B8}.exe 109 PID 3432 wrote to memory of 4912 3432 {6282681E-BD07-4fa8-A234-514DC17261B8}.exe 109 PID 4764 wrote to memory of 4540 4764 {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe 110 PID 4764 wrote to memory of 4540 4764 {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe 110 PID 4764 wrote to memory of 4540 4764 {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe 110 PID 4764 wrote to memory of 3876 4764 {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe 111 PID 4764 wrote to memory of 3876 4764 {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe 111 PID 4764 wrote to memory of 3876 4764 {AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe 111 PID 4540 wrote to memory of 3576 4540 {60C76FFD-F143-4714-BF5A-2309C859C948}.exe 112 PID 4540 wrote to memory of 3576 4540 {60C76FFD-F143-4714-BF5A-2309C859C948}.exe 112 PID 4540 wrote to memory of 3576 4540 {60C76FFD-F143-4714-BF5A-2309C859C948}.exe 112 PID 4540 wrote to memory of 1572 4540 {60C76FFD-F143-4714-BF5A-2309C859C948}.exe 113 PID 4540 wrote to memory of 1572 4540 {60C76FFD-F143-4714-BF5A-2309C859C948}.exe 113 PID 4540 wrote to memory of 1572 4540 {60C76FFD-F143-4714-BF5A-2309C859C948}.exe 113 PID 3576 wrote to memory of 2004 3576 {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe 114 PID 3576 wrote to memory of 2004 3576 {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe 114 PID 3576 wrote to memory of 2004 3576 {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe 114 PID 3576 wrote to memory of 1092 3576 {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe 115 PID 3576 wrote to memory of 1092 3576 {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe 115 PID 3576 wrote to memory of 1092 3576 {B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe 115 PID 2004 wrote to memory of 4284 2004 {A95A082B-CFE7-4313-B913-807B6285602F}.exe 116 PID 2004 wrote to memory of 4284 2004 {A95A082B-CFE7-4313-B913-807B6285602F}.exe 116 PID 2004 wrote to memory of 4284 2004 {A95A082B-CFE7-4313-B913-807B6285602F}.exe 116 PID 2004 wrote to memory of 1480 2004 {A95A082B-CFE7-4313-B913-807B6285602F}.exe 117 PID 2004 wrote to memory of 1480 2004 {A95A082B-CFE7-4313-B913-807B6285602F}.exe 117 PID 2004 wrote to memory of 1480 2004 {A95A082B-CFE7-4313-B913-807B6285602F}.exe 117 PID 4284 wrote to memory of 3348 4284 {15719FE1-7CAA-416d-A364-4011D2733F88}.exe 118 PID 4284 wrote to memory of 3348 4284 {15719FE1-7CAA-416d-A364-4011D2733F88}.exe 118 PID 4284 wrote to memory of 3348 4284 {15719FE1-7CAA-416d-A364-4011D2733F88}.exe 118 PID 4284 wrote to memory of 4588 4284 {15719FE1-7CAA-416d-A364-4011D2733F88}.exe 119 PID 4284 wrote to memory of 4588 4284 {15719FE1-7CAA-416d-A364-4011D2733F88}.exe 119 PID 4284 wrote to memory of 4588 4284 {15719FE1-7CAA-416d-A364-4011D2733F88}.exe 119 PID 3348 wrote to memory of 332 3348 {E87A6574-CB28-424e-AF9D-99382AE1C824}.exe 120 PID 3348 wrote to memory of 332 3348 {E87A6574-CB28-424e-AF9D-99382AE1C824}.exe 120 PID 3348 wrote to memory of 332 3348 {E87A6574-CB28-424e-AF9D-99382AE1C824}.exe 120 PID 3348 wrote to memory of 4708 3348 {E87A6574-CB28-424e-AF9D-99382AE1C824}.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5c9799fbc1eb579e502e343c4b601e60_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\{F5454831-6705-4e6a-BB31-0CE830F7D917}.exeC:\Windows\{F5454831-6705-4e6a-BB31-0CE830F7D917}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\{1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exeC:\Windows\{1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Windows\{8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exeC:\Windows\{8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\{6282681E-BD07-4fa8-A234-514DC17261B8}.exeC:\Windows\{6282681E-BD07-4fa8-A234-514DC17261B8}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\{AFD7FBA9-1F97-4106-829B-60D78048C35A}.exeC:\Windows\{AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\{60C76FFD-F143-4714-BF5A-2309C859C948}.exeC:\Windows\{60C76FFD-F143-4714-BF5A-2309C859C948}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\{B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exeC:\Windows\{B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\{A95A082B-CFE7-4313-B913-807B6285602F}.exeC:\Windows\{A95A082B-CFE7-4313-B913-807B6285602F}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\{15719FE1-7CAA-416d-A364-4011D2733F88}.exeC:\Windows\{15719FE1-7CAA-416d-A364-4011D2733F88}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\{E87A6574-CB28-424e-AF9D-99382AE1C824}.exeC:\Windows\{E87A6574-CB28-424e-AF9D-99382AE1C824}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\{4D4292F5-B846-4127-B4A4-5D68C403C0D7}.exeC:\Windows\{4D4292F5-B846-4127-B4A4-5D68C403C0D7}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:332 -
C:\Windows\{B6E356DB-BA0E-4894-B7C2-E3E3D492BE8A}.exeC:\Windows\{B6E356DB-BA0E-4894-B7C2-E3E3D492BE8A}.exe13⤵
- Executes dropped EXE
PID:4596
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D429~1.EXE > nul13⤵PID:4668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E87A6~1.EXE > nul12⤵PID:4708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15719~1.EXE > nul11⤵PID:4588
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A95A0~1.EXE > nul10⤵PID:1480
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B539D~1.EXE > nul9⤵PID:1092
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60C76~1.EXE > nul8⤵PID:1572
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFD7F~1.EXE > nul7⤵PID:3876
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{62826~1.EXE > nul6⤵PID:4912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8EDAC~1.EXE > nul5⤵PID:4668
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D5C2~1.EXE > nul4⤵PID:3184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5454~1.EXE > nul3⤵PID:4452
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\5C9799~1.EXE > nul2⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:81⤵PID:4388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{15719FE1-7CAA-416d-A364-4011D2733F88}.exe
- Size 60KB
- SHA256 ce06a97211f0ade55ccc2faabf2ac927d8c79a588fa5580cc85b378007424072
- MD5 c1a459e72a8f95b1053e99aa83897f70
- SHA1 88f6f8c7419eddc83075bb7403d3aec04942985a
- SHA512 29c6cb19e850b4933114b2be406292ec416871c24fdd25d68364e9b8a02bf5db3515bb67c80f57948ba8b7a429aca72a80b327d804a64490aba0742b0a686c31
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro24/CFsrdHWMZo:vvw9816vhKQLro24/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{1D5C2C9E-D4B3-435e-B4D4-4ADA11BD60AC}.exe
- Size 60KB
- SHA256 f5dbcef2397f5f8f659b946b48cc8689a52019e1e4b3dd01e52d06625df556ea
- MD5 ac9271a8e612d6bcbed361be3021c1b6
- SHA1 e820223728172032b167f998c07071207dfbaa6e
- SHA512 b763ad6cd4f7e1235f6bc615b98e5d340b8fd686f99f17f90693f83764a7a00b75f0920bd226dbb3c43d01008c172e123d5bac9b6abb4f9a52a1b57a9da49195
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrot4/CFsrdHWMZo:vvw9816vhKQLrot4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{4D4292F5-B846-4127-B4A4-5D68C403C0D7}.exe
- Size 60KB
- SHA256 186114cc434056aded73fabc283f86b0315ffc7c7457f03b940cad9dc012686e
- MD5 0deaeea9822bb2e808726f00bfc50b20
- SHA1 2d147d13366fb86f60c6de992fd79ffe08aad301
- SHA512 02d28deb969c45052cf5fc55431943f2eecf6cb89202048963c4bbd896e93ca70ffa2bed1dc60a7b5b06f9106f411b92ef0a3ebe4194a48d4a4e5122092a1db7
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroR4/CFsrdHWMZo:vvw9816vhKQLroR4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{60C76FFD-F143-4714-BF5A-2309C859C948}.exe
- Size 60KB
- SHA256 8ec45b4dbc762ae68b6932108e4a7521b0ea510cb926d10fb65b253dc684e9f2
- MD5 698c795d356674c377bed8b12fcf4071
- SHA1 37bb0ffaaf8612d81f186e2b44c22f75e8d4b155
- SHA512 e2a24a4f9c9372fcc6d89434232bab1d2a64d0b3d398649d962fe606596c66e8ff27a51385dfc9b2245bbe269bddbf396ed433305bbf08faa5e6e93504e0324b
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroTs4/CFsrdHWMZo:vvw9816vhKQLroTs4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{6282681E-BD07-4fa8-A234-514DC17261B8}.exe
- Size 60KB
- SHA256 709ab5b7d04448070345066cb08215245c84cded20c8ecabbc13c3888177c902
- MD5 f0da23ced9d2274e1548bc9d06fd24b6
- SHA1 6f57467bfd00985c30ebe596bf9638f1233c4e64
- SHA512 634a69e3c4ab2977b0f0529728b860399c2b213ba60cb5b8b7281f7739a929f7d171de7529f01101dddcdad22068c9af2645ed9d4867e54a6baffe0f0d7920fe
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro/4/CFsrdHWMZo:vvw9816vhKQLro/4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8EDACD8E-86B7-4571-A606-5ADD0CAAB67C}.exe
- Size 60KB
- SHA256 e5af39766780d707ca93b7d434966b2a732ea8d1706765e8b1a7ffb3f3efe897
- MD5 412d871f4d15336f827878d6afee0df1
- SHA1 fad6b422688dd9c1c0b1ed0efd8242cb141af41b
- SHA512 f2c3881c8c1b4850f00313d0e27c364abab26da8c941525f4e4e25cc67d2a396643e30e3b8eef4b84902e893f086a798478b313877100713685e04ca09a221b9
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrob4/CFsrdHWMZo:vvw9816vhKQLrob4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{A95A082B-CFE7-4313-B913-807B6285602F}.exe
- Size 60KB
- SHA256 6145292a6e6005e1a95230fa02ebb8cd7f940af281022f29e1213e99ee67afc9
- MD5 446d2cde4682e81efd614da246f82f30
- SHA1 6f7cf7fa7d13ab66f09a698f8758142cc16b96da
- SHA512 9e2aaa66874e2166b25de9f7155f5a56f9d274ea81a9a4904dea7bd2f033158372a727ba42b6c8e43478709203ca9f1de6c0ccbe1a80412f5f361dae374b8884
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroM4/CFsrdHWMZo:vvw9816vhKQLroM4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{AFD7FBA9-1F97-4106-829B-60D78048C35A}.exe
- Size 60KB
- SHA256 eb60d390884629ee06ec02c09f0aba6238735da989f3f02036fe8c61d50fa727
- MD5 b767b02a524f46048761f30fe0533135
- SHA1 84412c9e2fe0f8b5fba1c018ab9af3127a9182fb
- SHA512 de1597f142d87cec06d9849cbf57d89315337017fa2f4a3248695c2054cf97e3b26fc143f82a3d5758bcd9856be0dd9f4991ef9951332c44f7c604284f014050
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroj4/CFsrdHWMZo:vvw9816vhKQLroj4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B539D8BF-1DFB-478a-8B3D-E63BAC8E2B01}.exe
- Size 60KB
- SHA256 8ba422c472f867fe63814fdde0b928e6987292f9aa9c6da7f5066201f6d312db
- MD5 be5e5c273ba6c9760be7d42d9713abd6
- SHA1 45c6d5c429c662d1f7b57804723301d7b76ffbc8
- SHA512 127a45b622d40a737e9c5cd017b989003c5c92fc5dfcbe50d227133c46b4927f898210750e2497565006513973d7065b8203a4a1a3286f2e18b5ee7b0ce6f88a
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrow4/CFsrdHWMZo:vvw9816vhKQLrow4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B6E356DB-BA0E-4894-B7C2-E3E3D492BE8A}.exe
- Size 60KB
- SHA256 977bfecae729e5258c4242951368edbed6dd221ac5758becf238cdfa07f3bdb8
- MD5 d7107a0644fcc5293f16edd76cb6a422
- SHA1 ab6385b9ebbd2bb0f3673ad5303fa421a86eb755
- SHA512 010d7e916a72ef768cd9f02b0d5ffb22f67c3e61737ed18a66bcacceae06baa7d3c15f13a95fa108023b1ccc3b99e21719f8beca78b6f50e361521d34e1a53d5
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroo4/CFsrdHWMZo:vvw9816vhKQLroo4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{E87A6574-CB28-424e-AF9D-99382AE1C824}.exe
- Size 60KB
- SHA256 d356ba95ee519204e90fff1af7042344c9cfb0c5260688e72a46b6e3850534dc
- MD5 fd25fdfd5e2326253245af8ce6dfc407
- SHA1 101c6725f74c51ff3f84507f8bc37885ef9a1532
- SHA512 60991514d2dccc8557d4fe3fdd29825cca4b73f89e17ef15cc649343242523f121e32cf9f182ec5f4128abab5672cbe46da12146055f49cf6515de4ac2f8ef09
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrol4/CFsrdHWMZo:vvw9816vhKQLrol4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F5454831-6705-4e6a-BB31-0CE830F7D917}.exe
- Size 60KB
- SHA256 ec8a6224ad873f561f9746fde85eae05a7cef488a045b90e940aaa8b0d88d986
- MD5 2eef343d07e6213d3c99172bca96e8b9
- SHA1 9d32cec6d354f326899df454ffda953831ccb530
- SHA512 f2b68d9f8f16b74dfde5908014e2b7e805395a22c0119c7aef7437eb982ccbf63d116fa48265c3f989daa255fb936cfb6067a17c33723dac9e9de1342c152376
- SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrou4/CFsrdHWMZo:vvw9816vhKQLrou4/wQpWMZo
- MD5 SHA1 SHA512 SSDEEP