379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907

Analysis

max time kernel
80s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
Size

232KB
MD5

a820ce94b607ab36c7b039bafe047610
SHA1

dd55eb9e729433d661a9e0f8c78df1648f8d7bc9
SHA256

379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907
SHA512

60cdaf8158e0a587af87d6e0b17aa6ecdead795a1bda9d5710cec030431b437735816beefd5ab4563c544f56ff5c733552469bbb5429dd0b72c47f5a6ee2f122
SSDEEP

3072:p1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1Vne1i/NU82OMYcYU:ri/NjO5xbg/CSUFLTwMjs6wi/N+O7

Score

8^/10

defense_evasion persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe"	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3552-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/files/0x00090000000233ed-10.dat	upx
behavioral2/files/0x00070000000233f1-11.dat	upx
behavioral2/memory/3552-12-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2548	cmd.exe
4812	cmd.exe
448	cmd.exe
3720	cmd.exe
3180	cmd.exe
2448	cmd.exe
4744	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\windows.exe	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
File opened for modification	C:\WINDOWS\windows.exe	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
File opened for modification	C:\WINDOWS\windows.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5077c119c4c6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4032c619c4c6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078f1237f04e5404da848d5bad8ef8626000000000200000000001066000000010000200000000d2aafef50b58abe10e2f5eda5f109adbb9e9181adb229b08061bd6584d54d14000000000e8000000002000020000000765c89a0afa28ac6bcf9788643df791076eb82972af86adae6145d18644b272e20000000ebdc5df537ef3fcbce3a7197c0c1ea73553c3152143bd1c09ac7b20b5cb3b53f40000000b82b31970ea19ada0ed778b64be05f049fe1c51de91d86fef436ea76271986a2bd45fd4bb4b8be760c78cc48b5b37c2ff44f72b806da9eaa05c6de45dae7111e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{36F1FF30-32B7-11EF-9519-5ABC67A14C95} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078f1237f04e5404da848d5bad8ef8626000000000200000000001066000000010000200000005d4b5fcfdfa2571adab70ac1de017a38d826c5aeb76975383a647cc8cc585112000000000e8000000002000020000000028e59b447700d725dfdc391926e185a6c69555911590111e042a70777c6293220000000359eab2b0c2bd0dab207f9c243a9221bc39cc5abe3b7ac6c51ecab3aff17e8554000000030ca90ced3c21834cfac38a4809a26ceb085bfd8308869802309b9f7edde9aeda684e0b194e802e2715ebb9cee6a3da6b3a1b941a2b9bb4a13bf0a3d85f8e8f9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425456673"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4640	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
4640	iexplore.exe
4640	iexplore.exe
4864	IEXPLORE.EXE
4864	IEXPLORE.EXE
4864	IEXPLORE.EXE
4864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4640	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	80
PID 3552 wrote to memory of 4640	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	80
PID 4640 wrote to memory of 4864	4640	iexplore.exe	81
PID 4640 wrote to memory of 4864	4640	iexplore.exe	81
PID 4640 wrote to memory of 4864	4640	iexplore.exe	81
PID 3552 wrote to memory of 3180	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	82
PID 3552 wrote to memory of 3180	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	82
PID 3552 wrote to memory of 3180	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	82
PID 3180 wrote to memory of 4908	3180	cmd.exe	84
PID 3180 wrote to memory of 4908	3180	cmd.exe	84
PID 3180 wrote to memory of 4908	3180	cmd.exe	84
PID 3552 wrote to memory of 2448	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	85
PID 3552 wrote to memory of 2448	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	85
PID 3552 wrote to memory of 2448	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	85
PID 2448 wrote to memory of 4480	2448	cmd.exe	87
PID 2448 wrote to memory of 4480	2448	cmd.exe	87
PID 2448 wrote to memory of 4480	2448	cmd.exe	87
PID 3552 wrote to memory of 4744	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	88
PID 3552 wrote to memory of 4744	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	88
PID 3552 wrote to memory of 4744	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	88
PID 4744 wrote to memory of 5028	4744	cmd.exe	90
PID 4744 wrote to memory of 5028	4744	cmd.exe	90
PID 4744 wrote to memory of 5028	4744	cmd.exe	90
PID 3552 wrote to memory of 2548	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	91
PID 3552 wrote to memory of 2548	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	91
PID 3552 wrote to memory of 2548	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	91
PID 2548 wrote to memory of 4488	2548	cmd.exe	93
PID 2548 wrote to memory of 4488	2548	cmd.exe	93
PID 2548 wrote to memory of 4488	2548	cmd.exe	93
PID 3552 wrote to memory of 4812	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	94
PID 3552 wrote to memory of 4812	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	94
PID 3552 wrote to memory of 4812	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	94
PID 4812 wrote to memory of 1648	4812	cmd.exe	96
PID 4812 wrote to memory of 1648	4812	cmd.exe	96
PID 4812 wrote to memory of 1648	4812	cmd.exe	96
PID 3552 wrote to memory of 448	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	97
PID 3552 wrote to memory of 448	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	97
PID 3552 wrote to memory of 448	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	97
PID 448 wrote to memory of 1328	448	cmd.exe	99
PID 448 wrote to memory of 1328	448	cmd.exe	99
PID 448 wrote to memory of 1328	448	cmd.exe	99
PID 3552 wrote to memory of 3720	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	100
PID 3552 wrote to memory of 3720	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	100
PID 3552 wrote to memory of 3720	3552	379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe	100
PID 3720 wrote to memory of 4976	3720	cmd.exe	102
PID 3720 wrote to memory of 4976	3720	cmd.exe	102
PID 3720 wrote to memory of 4976	3720	cmd.exe	102

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4480	attrib.exe
5028	attrib.exe
4488	attrib.exe
1648	attrib.exe
1328	attrib.exe
4976	attrib.exe
4908	attrib.exe

C:\Users\Admin\AppData\Local\Temp\379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\379788dfe178bdecc5ff7159ed8729eae34b5183f19a045bc7b265d572f89907_NeikiAnalytics.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4640 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:4908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:4480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - Views/modifies file attributes
    PID:5028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:1648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\WINDOWS\windows.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "c:\system.exe"
    3⤵
    - Views/modifies file attributes
    PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\windows.exe

Filesize
232KB

MD5
0ee754bdcdf92f7ccfeb8d075439bdda

SHA1
acf667f68805cfdfdf99aed4b7c8379f5109ee40

SHA256
0532da7ce0eb19fb736d5183e261595bf0f2b82668aecf834a42cbfddd051fb8

SHA512
5b41acbc1f3fb7e58c7445025782019e7c4c69cba17916df5be96c1b65fd8e1e1c865bb30893c96cfe4b8570c90f145a29c4685c365539448f1fa348d5ab3300

Download Submit
C:\system.exe

Filesize
232KB

MD5
4a918eafe19c55abd2b97df5eb34103c

SHA1
f41278f503c6b49f17943bab9428fb5ee731613e

SHA256
40f202204fc2a74e325c9510cba6f6d7ec9bc32fb71c28fe871b45e60a67a3c0

SHA512
6773f80d5e8d3eb2060435fe36cb651d94ae775080e2a74f6da659d92be96107d78aab773016edd5ec7eeaafd9202241b054d509c9187cc4f84aea248c2872c6

Download Submit
memory/3552-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3552-12-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download