Analysis
-
max time kernel
91s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 08:22
Behavioral task
behavioral1
Sample
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe
-
Size
232KB
-
MD5
6c6ffe6dec9996e509c8b17333d1ed50
-
SHA1
a1d7fec43b3268afd22cf92f6fb6a4f418c741e3
-
SHA256
363b9c1d79698e5dfe0dbc430a76c424629420fa7d4bf9399df566855acc0e6c
-
SHA512
5c5d7968ce74fea3b70a8e21379cd2170519f41450f5adab7d04026eb723e5f6ed3539a8a0fba0ea70a7648050bb36d59c769454a1a254e5f82f60f06d42a9ec
-
SSDEEP
3072:m1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:Ai/NjO5xbg/CSUFLTwMjs6oi/N+O7
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5} 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe" 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/3756-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\WINDOWS\windows.exe upx C:\system.exe upx behavioral2/memory/3756-17-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
Processes:
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exedescription ioc process File created C:\WINDOWS\SysWOW64\ie.bat 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe File created C:\WINDOWS\SysWOW64\qx.bat 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe -
Drops file in Windows directory 3 IoCs
Processes:
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exeattrib.exedescription ioc process File created C:\WINDOWS\windows.exe 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe File opened for modification C:\WINDOWS\windows.exe 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe File opened for modification C:\WINDOWS\windows.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
iexplore.exe6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425031926" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112554" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3905864420" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10678df16abdda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04d99f16abdda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3902583942" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3902583942" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d651e1763920bb4d949d709c9307976a00000000020000000000106600000001000020000000a372e430eaaf73bc7553021c8ea083b765ccfffee093c2e118eed9ff70c3206c000000000e8000000002000020000000cabd7dfdd7d13b51ef20d5420c64eb91767d3ca5d3c4c4cf55d2fe8a6d7c2a3320000000d204789f3441270b92797c6aef047f420f420b2c0f938b280d2fb64ee9db766c40000000abb4543e7081de863852e9ad0a70bffacc340372625df981e1ed70510aba4fb849166e2416ea4c76135289a270ae0f099f927de0a58ce5367cb3e0052568c660 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31112554" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d651e1763920bb4d949d709c9307976a0000000002000000000010660000000100002000000059188ea2ebe4c8491d9be4bcd8992b927d719c0c8e2f005db6686241583d6b57000000000e80000000020000200000009e3b12c01f764f3dd969eff2a670f7ea2eee06938575fd0dca2a964945c7d29120000000c8cc251f9111a477861d5d07787aefad6575c2f8c9af9ec7c9b6f85544f9309e40000000c388722d5a732eccde7f75dd84c3d13d2a9009b8a6371beeb16eb85536fc2f5985c9ca8582ec461b8f4da6c53282199e969cf84e96c6509b7c221cda88a07244 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1433264F-295E-11EF-B1BA-F671300AD8E0} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31112554" IEXPLORE.EXE -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com" 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exepid process 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3940 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exeiexplore.exeIEXPLORE.EXEpid process 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe 3940 iexplore.exe 3940 iexplore.exe 3196 IEXPLORE.EXE 3196 IEXPLORE.EXE 3196 IEXPLORE.EXE 3196 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exeiexplore.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3756 wrote to memory of 3940 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe iexplore.exe PID 3756 wrote to memory of 3940 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe iexplore.exe PID 3940 wrote to memory of 3196 3940 iexplore.exe IEXPLORE.EXE PID 3940 wrote to memory of 3196 3940 iexplore.exe IEXPLORE.EXE PID 3940 wrote to memory of 3196 3940 iexplore.exe IEXPLORE.EXE PID 3756 wrote to memory of 4460 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 4460 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 4460 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 4460 wrote to memory of 4064 4460 cmd.exe attrib.exe PID 4460 wrote to memory of 4064 4460 cmd.exe attrib.exe PID 4460 wrote to memory of 4064 4460 cmd.exe attrib.exe PID 3756 wrote to memory of 700 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 700 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 700 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 700 wrote to memory of 4248 700 cmd.exe attrib.exe PID 700 wrote to memory of 4248 700 cmd.exe attrib.exe PID 700 wrote to memory of 4248 700 cmd.exe attrib.exe PID 3756 wrote to memory of 4180 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 4180 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 4180 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 4180 wrote to memory of 5048 4180 cmd.exe attrib.exe PID 4180 wrote to memory of 5048 4180 cmd.exe attrib.exe PID 4180 wrote to memory of 5048 4180 cmd.exe attrib.exe PID 3756 wrote to memory of 3564 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 3564 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 3564 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3564 wrote to memory of 2732 3564 cmd.exe attrib.exe PID 3564 wrote to memory of 2732 3564 cmd.exe attrib.exe PID 3564 wrote to memory of 2732 3564 cmd.exe attrib.exe PID 3756 wrote to memory of 1688 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 1688 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 1688 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 1688 wrote to memory of 1208 1688 cmd.exe attrib.exe PID 1688 wrote to memory of 1208 1688 cmd.exe attrib.exe PID 1688 wrote to memory of 1208 1688 cmd.exe attrib.exe PID 3756 wrote to memory of 3300 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 3300 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 3300 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3300 wrote to memory of 2792 3300 cmd.exe attrib.exe PID 3300 wrote to memory of 2792 3300 cmd.exe attrib.exe PID 3300 wrote to memory of 2792 3300 cmd.exe attrib.exe PID 3756 wrote to memory of 3076 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 3076 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3756 wrote to memory of 3076 3756 6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe cmd.exe PID 3076 wrote to memory of 656 3076 cmd.exe attrib.exe PID 3076 wrote to memory of 656 3076 cmd.exe attrib.exe PID 3076 wrote to memory of 656 3076 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 7 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 4248 attrib.exe 5048 attrib.exe 2732 attrib.exe 1208 attrib.exe 2792 attrib.exe 656 attrib.exe 4064 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6c6ffe6dec9996e509c8b17333d1ed50_NeikiAnalytics.exe"1⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3940 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3196
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:4064
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:4248
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"3⤵
- Views/modifies file attributes
PID:5048
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:2732
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"3⤵
- Views/modifies file attributes
PID:1208
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\WINDOWS\windows.exe"3⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:2792
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\attrib.exeattrib +h "c:\system.exe"3⤵
- Views/modifies file attributes
PID:656
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
232KB
MD5e706b502a0445b3694684f6db39fd01f
SHA1b376b23f044d1fb699a4852c0fdc2dd6309a9c4f
SHA256a7853828680ff3550c3b6c556ae5c3fb6caab68126658f3883599592b723159b
SHA512a0a17de6bdabbf4d939e4acf073938496e4128b11face1046d4da7cddcfa06388eb540563831205b8182d96be67fcb39b617d2057ab093879ac61c757ebfa811
-
Filesize
232KB
MD5c87c9b1345356d243ff802b454e2c9a3
SHA10a52667ad3290bc50d851245606882b9b10e144a
SHA256ca01a3cdfa36a3ca0e9d2c5924ef3f946f2087b9ec4b8837e9f5051a3814d593
SHA512b126709cb35297c06c37be9592185fb9549716298af430d3a9717a7cfe5a8f543d7aed5c03fda7be8b0e598b40fc4d603f8e33cda3fe7fe0bc545c541ebc7418