Analysis
- max time kernel
148s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
24/06/2024, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
39a04ab1e35395844a62aa2a24129cf2fcc2a9669d5c9a615366c3f12cfe826f_NeikiAnalytics.dll
Resource
win7-20240419-en
windows7-x64
15 signatures
150 seconds
General
- Target 39a04ab1e35395844a62aa2a24129cf2fcc2a9669d5c9a615366c3f12cfe826f_NeikiAnalytics.dll
- Size 120KB
- Sample240624-efjhcszemp
- SHA256 39a04ab1e35395844a62aa2a24129cf2fcc2a9669d5c9a615366c3f12cfe826f
- MD5 2c3e97360a8b1b4d1b37779a415410d0
- SHA1 13a8e58b7a7864a8dc46036e017d0f4abe612627
- SHA512 506c9d63cff3324c4132ccfadcfcae6d9414f088c9ae17f1f19217274e797e5a1a77a9ddb8cf3f3a8b5720f9fd7b8bfbcf57b076785a7fbcc15fe255cf035a7f
- SSDEEP 3072:WIROVMjgnpRV2JuYWn53unZb1sCtKd5MD7Bo:1OFfYqxunZbeCtQyB
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575738.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e573548.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e573548.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575738.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575738.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575738.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575738.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575738.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575738.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575738.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575738.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575738.exe - Executes dropped EXE 3 IoCs
pid Process 976 e573548.exe 2296 e573662.exe 636 e575738.exe -
resource yara_rule behavioral2/memory/976-6-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-10-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-9-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-8-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-17-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-27-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-18-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-31-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-26-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-35-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-36-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-37-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-38-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-39-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-40-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-50-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-51-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-61-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-62-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-64-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-65-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-66-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-69-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-72-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-75-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-76-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/976-80-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/636-112-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx behavioral2/memory/636-146-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e573548.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575738.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575738.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575738.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575738.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575738.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575738.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575738.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575738.exe - Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: e573548.exe File opened (read-only) \??\P: e573548.exe File opened (read-only) \??\G: e575738.exe File opened (read-only) \??\K: e573548.exe File opened (read-only) \??\M: e573548.exe File opened (read-only) \??\H: e575738.exe File opened (read-only) \??\E: e573548.exe File opened (read-only) \??\H: e573548.exe File opened (read-only) \??\I: e573548.exe File opened (read-only) \??\L: e573548.exe File opened (read-only) \??\O: e573548.exe File opened (read-only) \??\G: e573548.exe File opened (read-only) \??\N: e573548.exe File opened (read-only) \??\E: e575738.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe e573548.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e573548.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e573548.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e573597 e573548.exe File opened for modification C:\Windows\SYSTEM.INI e573548.exe File created C:\Windows\e5785d9 e575738.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 976 e573548.exe 976 e573548.exe 976 e573548.exe 976 e573548.exe 636 e575738.exe 636 e575738.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe Token: SeDebugPrivilege 976 e573548.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 620 wrote to memory of 1780 620 rundll32.exe 82 PID 620 wrote to memory of 1780 620 rundll32.exe 82 PID 620 wrote to memory of 1780 620 rundll32.exe 82 PID 1780 wrote to memory of 976 1780 rundll32.exe 83 PID 1780 wrote to memory of 976 1780 rundll32.exe 83 PID 1780 wrote to memory of 976 1780 rundll32.exe 83 PID 976 wrote to memory of 764 976 e573548.exe 8 PID 976 wrote to memory of 772 976 e573548.exe 9 PID 976 wrote to memory of 316 976 e573548.exe 13 PID 976 wrote to memory of 2444 976 e573548.exe 42 PID 976 wrote to memory of 2460 976 e573548.exe 43 PID 976 wrote to memory of 2580 976 e573548.exe 46 PID 976 wrote to memory of 3608 976 e573548.exe 56 PID 976 wrote to memory of 3736 976 e573548.exe 57 PID 976 wrote to memory of 3940 976 e573548.exe 58 PID 976 wrote to memory of 4032 976 e573548.exe 59 PID 976 wrote to memory of 724 976 e573548.exe 60 PID 976 wrote to memory of 3256 976 e573548.exe 61 PID 976 wrote to memory of 4240 976 e573548.exe 62 PID 976 wrote to memory of 4680 976 e573548.exe 64 PID 976 wrote to memory of 1636 976 e573548.exe 74 PID 976 wrote to memory of 4580 976 e573548.exe 79 PID 976 wrote to memory of 4880 976 e573548.exe 80 PID 976 wrote to memory of 620 976 e573548.exe 81 PID 976 wrote to memory of 1780 976 e573548.exe 82 PID 976 wrote to memory of 1780 976 e573548.exe 82 PID 1780 wrote to memory of 2296 1780 rundll32.exe 84 PID 1780 wrote to memory of 2296 1780 rundll32.exe 84 PID 1780 wrote to memory of 2296 1780 rundll32.exe 84 PID 1780 wrote to memory of 636 1780 rundll32.exe 92 PID 1780 wrote to memory of 636 1780 rundll32.exe 92 PID 1780 wrote to memory of 636 1780 rundll32.exe 92 PID 976 wrote to memory of 764 976 e573548.exe 8 PID 976 wrote to memory of 772 976 e573548.exe 9 PID 976 wrote to memory of 316 976 e573548.exe 13 PID 976 wrote to memory of 2444 976 e573548.exe 42 PID 976 wrote to memory of 2460 976 e573548.exe 43 PID 976 wrote to memory of 2580 976 e573548.exe 46 PID 976 wrote to memory of 3608 976 e573548.exe 56 PID 976 wrote to memory of 3736 976 e573548.exe 57 PID 976 wrote to memory of 3940 976 e573548.exe 58 PID 976 wrote to memory of 4032 976 e573548.exe 59 PID 976 wrote to memory of 724 976 e573548.exe 60 PID 976 wrote to memory of 3256 976 e573548.exe 61 PID 976 wrote to memory of 4240 976 e573548.exe 62 PID 976 wrote to memory of 4680 976 e573548.exe 64 PID 976 wrote to memory of 1636 976 e573548.exe 74 PID 976 wrote to memory of 4880 976 e573548.exe 80 PID 976 wrote to memory of 2296 976 e573548.exe 84 PID 976 wrote to memory of 2296 976 e573548.exe 84 PID 976 wrote to memory of 4624 976 e573548.exe 86 PID 976 wrote to memory of 1380 976 e573548.exe 87 PID 976 wrote to memory of 636 976 e573548.exe 92 PID 976 wrote to memory of 636 976 e573548.exe 92 PID 636 wrote to memory of 764 636 e575738.exe 8 PID 636 wrote to memory of 772 636 e575738.exe 9 PID 636 wrote to memory of 316 636 e575738.exe 13 PID 636 wrote to memory of 2444 636 e575738.exe 42 PID 636 wrote to memory of 2460 636 e575738.exe 43 PID 636 wrote to memory of 2580 636 e575738.exe 46 PID 636 wrote to memory of 3608 636 e575738.exe 56 PID 636 wrote to memory of 3736 636 e575738.exe 57 PID 636 wrote to memory of 3940 636 e575738.exe 58 PID 636 wrote to memory of 4032 636 e575738.exe 59 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e573548.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575738.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2460
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2580
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3608
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39a04ab1e35395844a62aa2a24129cf2fcc2a9669d5c9a615366c3f12cfe826f_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\39a04ab1e35395844a62aa2a24129cf2fcc2a9669d5c9a615366c3f12cfe826f_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\e573548.exeC:\Users\Admin\AppData\Local\Temp\e573548.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:976
-
-
C:\Users\Admin\AppData\Local\Temp\e573662.exeC:\Users\Admin\AppData\Local\Temp\e573662.exe4⤵
- Executes dropped EXE
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\e575738.exeC:\Users\Admin\AppData\Local\Temp\e575738.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:636
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3736
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3940
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4032
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:724
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3256
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4240
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4680
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1636
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4580
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4880
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4624
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1380
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e573548.exe
- Size 97KB
- SHA256 27b23ffa0bf796f5609d253daf37cd690ba9423a8997d5ba3fce190c769d1ded
- MD5 b5799a7a99fd6ceefd68a7aad7a2161c
- SHA1 a1bf3f58338ee5b7fa4eb049e6a29506b953d1d7
- SHA512 925524564e56e4561fa9687ab5128a7dd157a41f8d6f2fe5747424c8c3110329bd26085d3fd2c2b887de05361f71b595b0b7f82cbbb751f92145f38b40205961
- SSDEEP 3072:Rr20Rih6u0cm21LK7ud+LrBX2/w9rMybW:f4DX1Miur3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 92c3b23d2ec35f1bbc0ef7ccaf20b5b4334006883ff8e149066f655262cf5478
- MD5 dd397a59bf9f88c12aac459d825266dc
- SHA1 db73ede8cc2611039ddb9f0d203f45f1802c6527
- SHA512 ad6bd9be667c9b58a38f3ec5e6c894728e911da1f30c6969b72602bf127920acfe98132185ffb89df6721fa248ca659013ef8f9d5a5933ea0108ff312a58a734
- MD5 SHA1 SHA512