Analysis
- max time kernel
97s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
18 signatures
150 seconds
General
- Target 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe
- Size 542KB
- Sample240617-bwl2msscpj
- SHA256 842e36c3341012b2b4a4ba93306a9f341f150f124c67f2b839ea8c9ed489e3b4
- MD5 2e31947b461d41f8841ad6b7599da1c0
- SHA1 34397666cc9b7cbfc64cd87412b45796db7ebffc
- SHA512 85f2a89a7d0838eef2fe9112e0f7906e86e31a5b67a512ee171ebab0133184be80d3fadfca2c7f105d6b6ca4fad6715b7cf74d8f05d5a57b201bd025b93339cc
- SSDEEP 12288:C2/3R2TiOL8nBzcI8maanZ0qA/lf1DDZtmGfvvr9KfaajUIRKJCDPNKT1zH3/Iv:C278NaWr9KfDjUIMoDu173/Iv
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
-
http://klkjwre77638dfqwieuoi888.info/
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe - Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation Un_A.exe - Executes dropped EXE 1 IoCs
pid Process 3220 Un_A.exe - Loads dropped DLL 7 IoCs
pid Process 3220 Un_A.exe 3220 Un_A.exe 3220 Un_A.exe 3220 Un_A.exe 3220 Un_A.exe 3220 Un_A.exe 3220 Un_A.exe -
resource yara_rule behavioral2/memory/3500-1-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/3500-9-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/3500-13-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/3500-10-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/3500-27-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/3500-7-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/3500-8-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/3500-6-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/3500-5-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/3500-4-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/3500-3-0x0000000002390000-0x000000000341E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 4104 tasklist.exe 4268 tasklist.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 3220 Un_A.exe 3220 Un_A.exe 4104 tasklist.exe 4104 tasklist.exe 4268 tasklist.exe 4268 tasklist.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe Token: SeDebugPrivilege 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3500 wrote to memory of 784 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 9 PID 3500 wrote to memory of 792 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 10 PID 3500 wrote to memory of 316 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 13 PID 3500 wrote to memory of 2948 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 50 PID 3500 wrote to memory of 2972 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 51 PID 3500 wrote to memory of 3040 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 52 PID 3500 wrote to memory of 3420 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 56 PID 3500 wrote to memory of 3548 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 57 PID 3500 wrote to memory of 3756 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 58 PID 3500 wrote to memory of 3840 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 59 PID 3500 wrote to memory of 3904 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 60 PID 3500 wrote to memory of 3992 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 61 PID 3500 wrote to memory of 1872 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 62 PID 3500 wrote to memory of 4872 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 64 PID 3500 wrote to memory of 3888 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 74 PID 3500 wrote to memory of 4752 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 78 PID 3500 wrote to memory of 4692 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 79 PID 3500 wrote to memory of 3220 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 82 PID 3500 wrote to memory of 3220 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 82 PID 3500 wrote to memory of 3220 3500 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe 82 PID 3220 wrote to memory of 1868 3220 Un_A.exe 83 PID 3220 wrote to memory of 1868 3220 Un_A.exe 83 PID 3220 wrote to memory of 1868 3220 Un_A.exe 83 PID 1868 wrote to memory of 4104 1868 cmd.exe 86 PID 1868 wrote to memory of 4104 1868 cmd.exe 86 PID 1868 wrote to memory of 4104 1868 cmd.exe 86 PID 1868 wrote to memory of 3828 1868 cmd.exe 87 PID 1868 wrote to memory of 3828 1868 cmd.exe 87 PID 1868 wrote to memory of 3828 1868 cmd.exe 87 PID 3220 wrote to memory of 1288 3220 Un_A.exe 91 PID 3220 wrote to memory of 1288 3220 Un_A.exe 91 PID 3220 wrote to memory of 1288 3220 Un_A.exe 91 PID 1288 wrote to memory of 4268 1288 cmd.exe 93 PID 1288 wrote to memory of 4268 1288 cmd.exe 93 PID 1288 wrote to memory of 4268 1288 cmd.exe 93 PID 1288 wrote to memory of 3432 1288 cmd.exe 94 PID 1288 wrote to memory of 3432 1288 cmd.exe 94 PID 1288 wrote to memory of 3432 1288 cmd.exe 94 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2972
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3040
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2e31947b461d41f8841ad6b7599da1c0_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"5⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
-
C:\Windows\SysWOW64\find.exefind "BlueStacksServices.exe"5⤵PID:3828
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq BlueStacksServices.exe" | find "BlueStacksServices.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq BlueStacksServices.exe"5⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
PID:4268
-
-
C:\Windows\SysWOW64\find.exefind "BlueStacksServices.exe"5⤵PID:3432
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3548
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3904
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1872
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4872
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3888
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4752
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4692
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E574FD5_Rar\Un_A.exe
- Size 462KB
- SHA256 a4bd67571bcba77ed3f5a4ebb2e2ffbc3d2320d8bf8b4b1fae2ca668af2149b8
- MD5 a5b90f557b45c1398fe648e4377bae9b
- SHA1 65e051d4faecc72528c77064b6c7b23fb419f04f
- SHA512 755c1b548870dbf48ab669f15d31f0e2eab55d0c1bc23d712cb0c977ddb1ea6f811f31b4933bc629d69f01e460c735047df49604433ab0a284a187a19dc49220
- SSDEEP 12288:SY/3R2TiOL8nBzcI8maanZ0qA/lf1DDZtmGfvvuRKJCDPNKT1zH3/Iv:SY78NaWuMoDu173/Iv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nst4FE6.tmp\INetC.dll
- Size 238KB
- SHA256 ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
- MD5 38caa11a462b16538e0a3daeb2fc0eaf
- SHA1 c22a190b83f4b6dc0d6a44b98eac1a89a78de55c
- SHA512 777135e05e908ac26bfce0a9c425b57f7132c1cdb0969bbb6ef625748c868860602bacc633c61cab36d0375b94b6bcfbd8bd8c7fa781495ef7332e362f8d44d1
- SSDEEP 3072:hD2ekNFXiQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0L:hD2vhaqoDfb6mxk2LqHXj3if/Pa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nst4FE6.tmp\StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nst4FE6.tmp\System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nst4FE6.tmp\WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nst4FE6.tmp\nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
- Size 542KB
- SHA256 842e36c3341012b2b4a4ba93306a9f341f150f124c67f2b839ea8c9ed489e3b4
- MD5 2e31947b461d41f8841ad6b7599da1c0
- SHA1 34397666cc9b7cbfc64cd87412b45796db7ebffc
- SHA512 85f2a89a7d0838eef2fe9112e0f7906e86e31a5b67a512ee171ebab0133184be80d3fadfca2c7f105d6b6ca4fad6715b7cf74d8f05d5a57b201bd025b93339cc
- SSDEEP 12288:C2/3R2TiOL8nBzcI8maanZ0qA/lf1DDZtmGfvvr9KfaajUIRKJCDPNKT1zH3/Iv:C278NaWr9KfDjUIMoDu173/Iv
- MD5 SHA1 SHA512 SSDEEP