3fd648fbfae214851ce8a7293a30c02807096b18fc3c9e2b79194ee3002a5aa1

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Size

91KB
MD5

693bad3183098db3806caec884dd5170
SHA1

0482612ac3ff27137d95e3d9f6fc6db2a98f516f
SHA256

3fd648fbfae214851ce8a7293a30c02807096b18fc3c9e2b79194ee3002a5aa1
SHA512

0874eafc0720dfc46b7f05e47621e62a5f759395c800c5f755b2218a5fdfc3857fa9d052a4be4d4852f43fac4279d209201851419b43cbf8c3185822be8129e5
SSDEEP

1536:kRsjd3GR2Dxy387Lnouy8VTSRsjd3GR2Dxy387Lnouy8VTb:kOgUXoutNSOgUXoutNb

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 7 IoCs

pid	Process
1636	xk.exe
2768	IExplorer.exe
2164	WINLOGON.EXE
1936	CSRSS.EXE
2152	SERVICES.EXE
1016	LSASS.EXE
1564	SMSS.EXE

Loads dropped DLL 12 IoCs

pid	Process
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2432-0-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0008000000015065-8.dat	upx
behavioral1/memory/2432-105-0x00000000031D0000-0x00000000031FF000-memory.dmp	upx
behavioral1/files/0x0009000000015686-109.dat	upx
behavioral1/memory/1636-110-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/1636-115-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015d90-114.dat	upx
behavioral1/memory/2768-122-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2768-125-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015dca-126.dat	upx
behavioral1/files/0x0006000000015e1d-138.dat	upx
behavioral1/memory/2164-137-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2432-144-0x00000000031D0000-0x00000000031FF000-memory.dmp	upx
behavioral1/files/0x0006000000015f73-149.dat	upx
behavioral1/memory/1936-151-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2432-152-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2152-161-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x0006000000015fef-162.dat	upx
behavioral1/memory/1016-171-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/files/0x000600000001611e-178.dat	upx
behavioral1/memory/1564-183-0x0000000000400000-0x000000000042F000-memory.dmp	upx
behavioral1/memory/2432-182-0x0000000000400000-0x000000000042F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mig2.scr	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\shell.exe	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shell.exe	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
File created	C:\Windows\xk.exe	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
1636	xk.exe
2768	IExplorer.exe
2164	WINLOGON.EXE
1936	CSRSS.EXE
2152	SERVICES.EXE
1016	LSASS.EXE
1564	SMSS.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 1636	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	28
PID 2432 wrote to memory of 1636	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	28
PID 2432 wrote to memory of 1636	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	28
PID 2432 wrote to memory of 1636	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	28
PID 2432 wrote to memory of 2768	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	29
PID 2432 wrote to memory of 2768	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	29
PID 2432 wrote to memory of 2768	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	29
PID 2432 wrote to memory of 2768	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	29
PID 2432 wrote to memory of 2164	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	30
PID 2432 wrote to memory of 2164	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	30
PID 2432 wrote to memory of 2164	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	30
PID 2432 wrote to memory of 2164	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	30
PID 2432 wrote to memory of 1936	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	31
PID 2432 wrote to memory of 1936	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	31
PID 2432 wrote to memory of 1936	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	31
PID 2432 wrote to memory of 1936	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	31
PID 2432 wrote to memory of 2152	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	32
PID 2432 wrote to memory of 2152	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	32
PID 2432 wrote to memory of 2152	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	32
PID 2432 wrote to memory of 2152	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	32
PID 2432 wrote to memory of 1016	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	33
PID 2432 wrote to memory of 1016	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	33
PID 2432 wrote to memory of 1016	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	33
PID 2432 wrote to memory of 1016	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	33
PID 2432 wrote to memory of 1564	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	34
PID 2432 wrote to memory of 1564	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	34
PID 2432 wrote to memory of 1564	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	34
PID 2432 wrote to memory of 1564	2432	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe	34

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	693bad3183098db3806caec884dd5170_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\693bad3183098db3806caec884dd5170_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\693bad3183098db3806caec884dd5170_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2432
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1636
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2768
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2164
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1936
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2152
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1016
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE

Filesize
91KB

MD5
28847c2613fa766378e6fce391e650dd

SHA1
0daa932a2dbd44bd527d5612e8aa1b02885dfc93

SHA256
8752c7aae78ae7d2d7425c2670991a4b14046d1ae6f21c8cd71669e5cf75b827

SHA512
d5851d2d03ae526f5a3f1806132f1d4df9796ae52eefc13aee60c3c8ea9cd33312d719244fcdf40a12af24f41ad91727db331b1977cddca3b578776e537c6a1f

Download Submit
C:\Users\Admin\AppData\Local\services.exe

Filesize
91KB

MD5
693bad3183098db3806caec884dd5170

SHA1
0482612ac3ff27137d95e3d9f6fc6db2a98f516f

SHA256
3fd648fbfae214851ce8a7293a30c02807096b18fc3c9e2b79194ee3002a5aa1

SHA512
0874eafc0720dfc46b7f05e47621e62a5f759395c800c5f755b2218a5fdfc3857fa9d052a4be4d4852f43fac4279d209201851419b43cbf8c3185822be8129e5

Download Submit
C:\Windows\xk.exe

Filesize
91KB

MD5
fefa4c5aa9392aca9a10bbb4f962b595

SHA1
58d4db5d99a50a5cc7250437f05681f86baa109c

SHA256
8f3f3cc4a7a7a42772f23eea27ca22d314fb9324b63058cf1f7beda7375ce225

SHA512
958957fafdb77cc27e2e3db7c05e358789855a281bad1da640e67a3b1b808757f7a9c4a3acfc63143a35e46bde5175e624176d81b006f74b54efc9e6b4fa78ff

Download Submit
\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE

Filesize
91KB

MD5
49f1733050185e9dec93bdb45a70cce9

SHA1
71d29152f38dd68711e3ef66adefdd1d182e4560

SHA256
227b5336a44c2a175d7234747cd189e02d47a02a2d33f2eaf71e1f5767371a9b

SHA512
8f104d7acd041f3dccaa312ade3e64a1b64e2db9a413f7a3efa53a61384ae1da0f12588551823e358925af4d6bbab76b0a67a34b0251cbf8e01d61c11e0a4425

Download Submit
\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE

Filesize
91KB

MD5
f8b09fe4974c9461e68b63b502a4cab7

SHA1
c51928772f048241cd716853802760f45e7604e7

SHA256
1a11698c662301ba3f793ab2e2ab8f2ad1eeaa4cfe50294183ae3fec3e3932e9

SHA512
c137a5b8d718068595db6e7f8524eea64f502cc0ef3afbc548c7dc87a0e7fa28847df0a690e89a59f6e940a8de0a3f980ec5f7d5ea74a00e6ad63feb026fbd31

Download Submit
\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

Filesize
91KB

MD5
9ad076dcfc81cc71fc9d3e25a0ef1cbf

SHA1
9c9e5e8c92011293a1e736d63015dedede9f6f7a

SHA256
2960337acad5e7aee6449bdb06ca0d9b9c0cdcee5d16cdc154f147f50c9367f4

SHA512
fdc3c306771599bb95d8ec3b1bf6309527562f1d4f36b703e07ded778a41e4e90c42acb706bd94f02849d37d9efc0e40dcbe589a79916cccf4b5cd23452e36d9

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
91KB

MD5
87a1379d20961cc2d6eaa0773720a98a

SHA1
7d470b8b339b2e11ee1286fb745e0654e9e78b2e

SHA256
10cd7064f33012e975e88ed093d5b355dd4165c47e961c69ec8e9ac00cedf1d4

SHA512
577f1a13fa15dcc54b4d38420092c7428791cdfd1109514e5854f40666cf41085683fef73a8e57265997831f4393944e9880da62d5e1d996e060eaca01deed9d

Download Submit
\Windows\SysWOW64\IExplorer.exe

Filesize
91KB

MD5
606082420e8ad0d6c72d14723083d913

SHA1
1aaaa227e1a7b326afa2cac8ae0d7aedf900c6f1

SHA256
590fef1476c73827dd554ab51cf47f90315bee4a96533dac8b6bd58bfcd24960

SHA512
d70cdd85d00702989a08a10adfb3a9b989af4eba906d56e403643b92a61769f2f7b3558bea6d52861d476cd1757427c9b7f4d3c54786a6910f04fb1281e93aad

Download Submit
memory/1016-171-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1564-183-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1636-110-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1636-115-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1936-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2152-161-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2164-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2432-144-0x00000000031D0000-0x00000000031FF000-memory.dmp

Filesize
188KB

Download
memory/2432-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2432-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2432-133-0x00000000031D0000-0x00000000031FF000-memory.dmp

Filesize
188KB

Download
memory/2432-105-0x00000000031D0000-0x00000000031FF000-memory.dmp

Filesize
188KB

Download
memory/2432-182-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2768-125-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2768-122-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download