5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe
Size

88KB
MD5

c1a7bb163f7188fa0ad05de0a0ba4700
SHA1

c3e8d865d8390780e04528015181056561ac168d
SHA256

5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9
SHA512

09cf46146a07506dfd05162377b03ed79cb5ae53c71c98a0dd8c4a7bc3c37489c2683b11cdd66373d42c57b289004450a82320cf324f4da27a47b338faa4ef43
SSDEEP

768:uvw981E9hKQLroI4/wQDNrfrunMxVFA3r:aEGJ0oIlYunMxVS3r

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7739298-5AAD-497f-951E-3396F417371B}	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}	{C7739298-5AAD-497f-951E-3396F417371B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{441B4882-893D-4033-A260-4B0064CB6084}\stubpath = "C:\\Windows\\{441B4882-893D-4033-A260-4B0064CB6084}.exe"	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C7739298-5AAD-497f-951E-3396F417371B}\stubpath = "C:\\Windows\\{C7739298-5AAD-497f-951E-3396F417371B}.exe"	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BE622E0-9259-472f-8AEE-6D265498C70D}\stubpath = "C:\\Windows\\{6BE622E0-9259-472f-8AEE-6D265498C70D}.exe"	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9B346E23-794D-4134-BEA6-A1543BEC7EF6}	{6BE622E0-9259-472f-8AEE-6D265498C70D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}\stubpath = "C:\\Windows\\{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}.exe"	{9B346E23-794D-4134-BEA6-A1543BEC7EF6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{529A2F3A-B058-453c-A35D-A519A2AF430D}\stubpath = "C:\\Windows\\{529A2F3A-B058-453c-A35D-A519A2AF430D}.exe"	{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{441B4882-893D-4033-A260-4B0064CB6084}	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}\stubpath = "C:\\Windows\\{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe"	{441B4882-893D-4033-A260-4B0064CB6084}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}\stubpath = "C:\\Windows\\{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe"	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8122AC0-1788-4880-AFD7-CCD4E006178B}\stubpath = "C:\\Windows\\{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe"	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BE622E0-9259-472f-8AEE-6D265498C70D}	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}	{9B346E23-794D-4134-BEA6-A1543BEC7EF6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}	{441B4882-893D-4033-A260-4B0064CB6084}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{B8122AC0-1788-4880-AFD7-CCD4E006178B}	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5B6C4223-0F35-4ddf-9468-259B771C6D96}	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5B6C4223-0F35-4ddf-9468-259B771C6D96}\stubpath = "C:\\Windows\\{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe"	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}\stubpath = "C:\\Windows\\{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe"	{C7739298-5AAD-497f-951E-3396F417371B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9B346E23-794D-4134-BEA6-A1543BEC7EF6}\stubpath = "C:\\Windows\\{9B346E23-794D-4134-BEA6-A1543BEC7EF6}.exe"	{6BE622E0-9259-472f-8AEE-6D265498C70D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{529A2F3A-B058-453c-A35D-A519A2AF430D}	{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}.exe

Deletes itself 1 IoCs

pid	Process
2852	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
3068	{441B4882-893D-4033-A260-4B0064CB6084}.exe
2684	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe
1764	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe
1876	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe
2064	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe
1780	{C7739298-5AAD-497f-951E-3396F417371B}.exe
2896	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe
1836	{6BE622E0-9259-472f-8AEE-6D265498C70D}.exe
2932	{9B346E23-794D-4134-BEA6-A1543BEC7EF6}.exe
536	{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}.exe
1772	{529A2F3A-B058-453c-A35D-A519A2AF430D}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{C7739298-5AAD-497f-951E-3396F417371B}.exe	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe
File created	C:\Windows\{6BE622E0-9259-472f-8AEE-6D265498C70D}.exe	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe
File created	C:\Windows\{9B346E23-794D-4134-BEA6-A1543BEC7EF6}.exe	{6BE622E0-9259-472f-8AEE-6D265498C70D}.exe
File created	C:\Windows\{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe	{441B4882-893D-4033-A260-4B0064CB6084}.exe
File created	C:\Windows\{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe
File created	C:\Windows\{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe
File created	C:\Windows\{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe
File created	C:\Windows\{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe	{C7739298-5AAD-497f-951E-3396F417371B}.exe
File created	C:\Windows\{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}.exe	{9B346E23-794D-4134-BEA6-A1543BEC7EF6}.exe
File created	C:\Windows\{529A2F3A-B058-453c-A35D-A519A2AF430D}.exe	{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}.exe
File created	C:\Windows\{441B4882-893D-4033-A260-4B0064CB6084}.exe	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	816	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	3068	{441B4882-893D-4033-A260-4B0064CB6084}.exe
Token: SeIncBasePriorityPrivilege	2684	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe
Token: SeIncBasePriorityPrivilege	1764	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe
Token: SeIncBasePriorityPrivilege	1876	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe
Token: SeIncBasePriorityPrivilege	2064	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe
Token: SeIncBasePriorityPrivilege	1780	{C7739298-5AAD-497f-951E-3396F417371B}.exe
Token: SeIncBasePriorityPrivilege	2896	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe
Token: SeIncBasePriorityPrivilege	1836	{6BE622E0-9259-472f-8AEE-6D265498C70D}.exe
Token: SeIncBasePriorityPrivilege	2932	{9B346E23-794D-4134-BEA6-A1543BEC7EF6}.exe
Token: SeIncBasePriorityPrivilege	536	{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 3068	816	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe	28
PID 816 wrote to memory of 3068	816	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe	28
PID 816 wrote to memory of 3068	816	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe	28
PID 816 wrote to memory of 3068	816	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe	28
PID 816 wrote to memory of 2852	816	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe	29
PID 816 wrote to memory of 2852	816	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe	29
PID 816 wrote to memory of 2852	816	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe	29
PID 816 wrote to memory of 2852	816	5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe	29
PID 3068 wrote to memory of 2684	3068	{441B4882-893D-4033-A260-4B0064CB6084}.exe	30
PID 3068 wrote to memory of 2684	3068	{441B4882-893D-4033-A260-4B0064CB6084}.exe	30
PID 3068 wrote to memory of 2684	3068	{441B4882-893D-4033-A260-4B0064CB6084}.exe	30
PID 3068 wrote to memory of 2684	3068	{441B4882-893D-4033-A260-4B0064CB6084}.exe	30
PID 3068 wrote to memory of 772	3068	{441B4882-893D-4033-A260-4B0064CB6084}.exe	31
PID 3068 wrote to memory of 772	3068	{441B4882-893D-4033-A260-4B0064CB6084}.exe	31
PID 3068 wrote to memory of 772	3068	{441B4882-893D-4033-A260-4B0064CB6084}.exe	31
PID 3068 wrote to memory of 772	3068	{441B4882-893D-4033-A260-4B0064CB6084}.exe	31
PID 2684 wrote to memory of 1764	2684	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe	32
PID 2684 wrote to memory of 1764	2684	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe	32
PID 2684 wrote to memory of 1764	2684	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe	32
PID 2684 wrote to memory of 1764	2684	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe	32
PID 2684 wrote to memory of 2724	2684	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe	33
PID 2684 wrote to memory of 2724	2684	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe	33
PID 2684 wrote to memory of 2724	2684	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe	33
PID 2684 wrote to memory of 2724	2684	{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe	33
PID 1764 wrote to memory of 1876	1764	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe	36
PID 1764 wrote to memory of 1876	1764	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe	36
PID 1764 wrote to memory of 1876	1764	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe	36
PID 1764 wrote to memory of 1876	1764	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe	36
PID 1764 wrote to memory of 2300	1764	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe	37
PID 1764 wrote to memory of 2300	1764	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe	37
PID 1764 wrote to memory of 2300	1764	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe	37
PID 1764 wrote to memory of 2300	1764	{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe	37
PID 1876 wrote to memory of 2064	1876	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe	38
PID 1876 wrote to memory of 2064	1876	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe	38
PID 1876 wrote to memory of 2064	1876	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe	38
PID 1876 wrote to memory of 2064	1876	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe	38
PID 1876 wrote to memory of 2880	1876	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe	39
PID 1876 wrote to memory of 2880	1876	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe	39
PID 1876 wrote to memory of 2880	1876	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe	39
PID 1876 wrote to memory of 2880	1876	{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe	39
PID 2064 wrote to memory of 1780	2064	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe	40
PID 2064 wrote to memory of 1780	2064	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe	40
PID 2064 wrote to memory of 1780	2064	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe	40
PID 2064 wrote to memory of 1780	2064	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe	40
PID 2064 wrote to memory of 872	2064	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe	41
PID 2064 wrote to memory of 872	2064	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe	41
PID 2064 wrote to memory of 872	2064	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe	41
PID 2064 wrote to memory of 872	2064	{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe	41
PID 1780 wrote to memory of 2896	1780	{C7739298-5AAD-497f-951E-3396F417371B}.exe	42
PID 1780 wrote to memory of 2896	1780	{C7739298-5AAD-497f-951E-3396F417371B}.exe	42
PID 1780 wrote to memory of 2896	1780	{C7739298-5AAD-497f-951E-3396F417371B}.exe	42
PID 1780 wrote to memory of 2896	1780	{C7739298-5AAD-497f-951E-3396F417371B}.exe	42
PID 1780 wrote to memory of 3024	1780	{C7739298-5AAD-497f-951E-3396F417371B}.exe	43
PID 1780 wrote to memory of 3024	1780	{C7739298-5AAD-497f-951E-3396F417371B}.exe	43
PID 1780 wrote to memory of 3024	1780	{C7739298-5AAD-497f-951E-3396F417371B}.exe	43
PID 1780 wrote to memory of 3024	1780	{C7739298-5AAD-497f-951E-3396F417371B}.exe	43
PID 2896 wrote to memory of 1836	2896	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe	44
PID 2896 wrote to memory of 1836	2896	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe	44
PID 2896 wrote to memory of 1836	2896	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe	44
PID 2896 wrote to memory of 1836	2896	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe	44
PID 2896 wrote to memory of 1744	2896	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe	45
PID 2896 wrote to memory of 1744	2896	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe	45
PID 2896 wrote to memory of 1744	2896	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe	45
PID 2896 wrote to memory of 1744	2896	{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe	45

C:\Users\Admin\AppData\Local\Temp\5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5e0ba73ebf737dc5348dab84a9ef0b1b6ec5f2a5d9a4f88dd54939d4c01118a9_NeikiAnalytics.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816
- C:\Windows\{441B4882-893D-4033-A260-4B0064CB6084}.exe
  C:\Windows\{441B4882-893D-4033-A260-4B0064CB6084}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe
    C:\Windows\{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe
      C:\Windows\{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\Windows\{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe
        
        C:\Windows\{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1876
      - C:\Windows\{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe
        
        C:\Windows\{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\{C7739298-5AAD-497f-951E-3396F417371B}.exe
        
        C:\Windows\{C7739298-5AAD-497f-951E-3396F417371B}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe
        
        C:\Windows\{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\{6BE622E0-9259-472f-8AEE-6D265498C70D}.exe
        
        C:\Windows\{6BE622E0-9259-472f-8AEE-6D265498C70D}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1836
        
        C:\Windows\{9B346E23-794D-4134-BEA6-A1543BEC7EF6}.exe
        
        C:\Windows\{9B346E23-794D-4134-BEA6-A1543BEC7EF6}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2932
        
        C:\Windows\{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}.exe
        
        C:\Windows\{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:536
        
        C:\Windows\{529A2F3A-B058-453c-A35D-A519A2AF430D}.exe
        
        C:\Windows\{529A2F3A-B058-453c-A35D-A519A2AF430D}.exe
        12⤵
        Executes dropped EXE
        
        PID:1772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C9959~1.EXE > nul
        12⤵
        
        PID:840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9B346~1.EXE > nul
        11⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6BE62~1.EXE > nul
        10⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{722C3~1.EXE > nul
        9⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C7739~1.EXE > nul
        8⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5B6C4~1.EXE > nul
        7⤵
        
        PID:872
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B8122~1.EXE > nul
        6⤵
        
        PID:2880
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CBF9C~1.EXE > nul
        5⤵
        
        PID:2300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{43351~1.EXE > nul
      4⤵
      PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{441B4~1.EXE > nul
    3⤵
    PID:772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\5E0BA7~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{43351AB9-A13D-4eeb-9289-6E32AE37C6B0}.exe

Filesize
88KB

MD5
7e83e4bba32a36c2e960d72ccd5bd816

SHA1
47b39924cdcb3f1fd9638d4052c21ae1609a4230

SHA256
b2d1d7421da622dd84cce0a16b9175b5973b02c069d262948b6eaa93327a8559

SHA512
ad5e6830b5fd7314dec09e16c54b52ab27a3344afd3c49e69f7d33eea01c846abe40ff026872333bf9008ce43eca8d56cc97e3e64fab52a6e21288d6b0c6a454

Download Submit
C:\Windows\{441B4882-893D-4033-A260-4B0064CB6084}.exe

Filesize
88KB

MD5
d7fd0a97e0f3898ed10dd862c0e88b4e

SHA1
a7a7fb3d1348cf6cb79e11cf3d30d9e6b48b0f9d

SHA256
95ef87904a6aa1f2cda74db407ad9f98e52057baa9da8b4680054216034517f7

SHA512
875f01816d460d853047ea4d020dc260ed03b359d69e4c9a98d3f1a983f0b0f24274477e17bdd79621a700f1cf2ef417a981447763b9f3262a682b3d48dbc47d

Download Submit
C:\Windows\{529A2F3A-B058-453c-A35D-A519A2AF430D}.exe

Filesize
88KB

MD5
28dbe24079f2ae0a1ebf317c5198bbd6

SHA1
905458ef0625e14dc98d63849273b13267aefdcb

SHA256
c61ac6cf71c7940b490a5cd49c98ce2ab8c29e433aaddd8be2c527d495a43373

SHA512
023373b25d9174f11bb608fd1cbb8b8e06f40c21f687b32a9c8b8991c327ca09a86ac562485906603f7284c1b5dba8173938896dd13a18ea01fb45d63cb696a4

Download Submit
C:\Windows\{5B6C4223-0F35-4ddf-9468-259B771C6D96}.exe

Filesize
88KB

MD5
ed156e54bfeefc101692bd5065db4c1d

SHA1
5c7d8acf0eed63d26b12514ba1fe2181eb3dab5f

SHA256
b933e7de52f37d32e4915b5f7e8273343ce441fc45bcfc8e557617b2978e89c5

SHA512
111ab263f642ffa7d636c4356e1d1d0aabe01a896b2341098c81abfa53eb589709c0a9987f89eae9f1e258b5cba8f6e618b71d2a298503b624bdea489e5295ca

Download Submit
C:\Windows\{6BE622E0-9259-472f-8AEE-6D265498C70D}.exe

Filesize
88KB

MD5
402757efe806182034bad4aaa7126a51

SHA1
72707960ebd6b8cba5136ece3667827854905175

SHA256
eb54586863763e05afef090c141f1254d7a5e2a60cd827efefe04055c1a97a83

SHA512
23317c2e3216c4c72ffe29040ff3d39c71e2923283a32a2791b4a00af143902a056cd8f91543e12f49b2ba9efab0e8133b88284d4e175dfaa1cd5612ae89fda0

Download Submit
C:\Windows\{722C339D-DF7F-41a6-BB3B-AC64CFE5CB6C}.exe

Filesize
88KB

MD5
9c7afb60713a41ef8e4df8bd1ef87dcd

SHA1
e02869f478d86f409a41de8003c4b353235c142e

SHA256
87a7c18abcbc6ef6dbe1aa5c1c6b88df846a47cc07547beffbd993bacbe2312d

SHA512
81ceda42847fa8fbabf72d9af1eb3dc6ea924fbb782de5cb59f21dd836e6b980655fc53b57128e8ec67a9ade113bdf5d20d1c93d4a7cf7025d498268a70a8223

Download Submit
C:\Windows\{9B346E23-794D-4134-BEA6-A1543BEC7EF6}.exe

Filesize
88KB

MD5
c7878a1ae494c34f7e4d082555c3c7c9

SHA1
830b7a5b16686b46d7245dd70dba0e104e9c0f28

SHA256
e5a9120437d8bcb93accf8ba29d228bd0c582dd5cb7aa518d7835c4c2eac72e0

SHA512
48f75bfa7fe85774b3ced28ca95cf45e23ef4bf1dcaef726969b8ae500fcf3e1563ec11335c29349c4185a2ad942b27185104834d321de3513f083a89f717bf4

Download Submit
C:\Windows\{B8122AC0-1788-4880-AFD7-CCD4E006178B}.exe

Filesize
88KB

MD5
3fffa5bbada0655974c949adfd4fe70b

SHA1
bc7f3a989cba136679daa92eedd47d0c7e753a3c

SHA256
5ca10b0aa2008af2852683f07fd8b5e9c08e5c1539e8368c4203059e14342d0e

SHA512
145fbb6b3106af4647961de0f3235e17837f7e7746217e6a2d6f2262c0b50c3344091599748a8a0289718d758f7b4b13e0f7a9257322952f708a9b55720ee74e

Download Submit
C:\Windows\{C7739298-5AAD-497f-951E-3396F417371B}.exe

Filesize
88KB

MD5
520ba89ba9f39d1932d44f6eed2c7790

SHA1
d87cdaf1e6b024d4aed51bac47de317c3b0ffdea

SHA256
fb48b8ab0db633a070c00fdd7fa74f91eb153a5cde28560e87c30520c26c0281

SHA512
60d04ca62b6394c1caffa8b8bec3e07670994631584b879d4af44c6d344f9f8094895dad2f3fef29ae49a63206e0a2413abb3f19575d6b2e1c9bf0738f54de9a

Download Submit
C:\Windows\{C9959497-5FDF-4583-A170-CB3E4EB9D0BE}.exe

Filesize
88KB

MD5
68a780a0d34359ef857159dc0d32b731

SHA1
44b8e082fad3a20df3df6b70f296c0c4a918fe21

SHA256
7f02012c8deb51a0faced87208b1d375a95d0c980f73baffdc88b952e0e0cd1e

SHA512
876dd1e9c336e703e582ffa4e06149a958e37c13cacc5a681257521f26cec0d69cc3ecaab4b448f5d2f358d6ed71e1b39ca57214bd13a102a4446d547969606b

Download Submit
C:\Windows\{CBF9C84B-6FB9-4174-BD1C-A2528351B4CB}.exe

Filesize
88KB

MD5
43279cc28e664dc2d3989931b152b8a8

SHA1
4f7dbbe5bcc572e95d92cbfb9da4e0e5abf25a29

SHA256
0e8bdc600c7a1de741557f07ecad7186d93caae06ec48dc564cb553e69079420

SHA512
9bb22432fc1d22876909677aba9750b6c0a685e0d6de7f681ca02692845ee0149f348cea1c8daf936f12299bd83b6e3817737a70305ddb9847bebcc17ba556b6

Download Submit
memory/536-96-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/816-10-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/816-7-0x0000000000390000-0x00000000003A1000-memory.dmp

Filesize
68KB

Download
memory/816-8-0x0000000000390000-0x00000000003A1000-memory.dmp

Filesize
68KB

Download
memory/816-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1764-35-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1772-98-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1780-63-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1780-61-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download
memory/1780-60-0x00000000003E0000-0x00000000003F1000-memory.dmp

Filesize
68KB

Download
memory/1836-81-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1836-73-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1876-42-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2064-52-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2064-44-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2684-26-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2684-19-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2896-71-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2896-67-0x0000000000420000-0x0000000000431000-memory.dmp

Filesize
68KB

Download
memory/2896-62-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2932-89-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3068-18-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3068-9-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads