Analysis
- max time kernel
51s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
25/06/2024, 08:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
467e8f459ee8630ed2157065235fbc782afa03a92ad8d92a06b7606ed8cbf9ce_NeikiAnalytics.dll
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
General
- Target 467e8f459ee8630ed2157065235fbc782afa03a92ad8d92a06b7606ed8cbf9ce_NeikiAnalytics.dll
- Size 120KB
- Sample240625-j67ebsycnc
- SHA256 467e8f459ee8630ed2157065235fbc782afa03a92ad8d92a06b7606ed8cbf9ce
- MD5 bd8b156fae1ffad61e4d4a846adac560
- SHA1 ef5f9cffe842d845e8e2a26a94d6fbcbf2798558
- SHA512 90543941667a4770736222bd38fc4b2969f5e98452b2dbf17d6f27a7f2b9a28baa79ce92117a617eb775566a802255879cf67a5e6959c373e67770c78f8ca61a
- SSDEEP 3072:T6WnIgVSW5+kzrBnO7Cniyj/PEsDnsvdhyDmBezVeX:Vzxrg7QJ7E2svdKAQ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5743a0.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575e7b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5743a0.exe - Executes dropped EXE 3 IoCs
pid Process 1912 e5742a6.exe 640 e5743a0.exe 1512 e575e7b.exe -
resource yara_rule behavioral2/memory/1912-8-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-9-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-6-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-13-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-26-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-27-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-12-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-11-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-10-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-33-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-28-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-36-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-37-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-38-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-39-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-40-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-42-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-43-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-51-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-53-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-54-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-64-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-66-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-69-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-71-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-73-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-75-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-76-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-78-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-79-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-80-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/1912-85-0x00000000007C0000-0x000000000187A000-memory.dmp upx behavioral2/memory/640-118-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral2/memory/640-124-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral2/memory/1512-149-0x0000000000B30000-0x0000000001BEA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5742a6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5743a0.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e575e7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e575e7b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5742a6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575e7b.exe - Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: e5742a6.exe File opened (read-only) \??\E: e5742a6.exe File opened (read-only) \??\H: e5742a6.exe File opened (read-only) \??\J: e5742a6.exe File opened (read-only) \??\N: e5742a6.exe File opened (read-only) \??\G: e5742a6.exe File opened (read-only) \??\O: e5742a6.exe File opened (read-only) \??\K: e5742a6.exe File opened (read-only) \??\Q: e5742a6.exe File opened (read-only) \??\S: e5742a6.exe File opened (read-only) \??\I: e5742a6.exe File opened (read-only) \??\L: e5742a6.exe File opened (read-only) \??\M: e5742a6.exe File opened (read-only) \??\R: e5742a6.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.exe e5742a6.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e5742a6.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e5742a6.exe File opened for modification C:\Program Files\7-Zip\7z.exe e5742a6.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e5742a6.exe File created C:\Windows\e579385 e5743a0.exe File created C:\Windows\e57ad18 e575e7b.exe File created C:\Windows\e5742f4 e5742a6.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1912 e5742a6.exe 1912 e5742a6.exe 1912 e5742a6.exe 1912 e5742a6.exe 640 e5743a0.exe 640 e5743a0.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe Token: SeDebugPrivilege 1912 e5742a6.exe - Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1244 1720 rundll32.exe 81 PID 1720 wrote to memory of 1244 1720 rundll32.exe 81 PID 1720 wrote to memory of 1244 1720 rundll32.exe 81 PID 1244 wrote to memory of 1912 1244 rundll32.exe 82 PID 1244 wrote to memory of 1912 1244 rundll32.exe 82 PID 1244 wrote to memory of 1912 1244 rundll32.exe 82 PID 1912 wrote to memory of 776 1912 e5742a6.exe 8 PID 1912 wrote to memory of 780 1912 e5742a6.exe 9 PID 1912 wrote to memory of 64 1912 e5742a6.exe 13 PID 1912 wrote to memory of 2552 1912 e5742a6.exe 42 PID 1912 wrote to memory of 2560 1912 e5742a6.exe 43 PID 1912 wrote to memory of 2672 1912 e5742a6.exe 46 PID 1912 wrote to memory of 3528 1912 e5742a6.exe 56 PID 1912 wrote to memory of 3636 1912 e5742a6.exe 57 PID 1912 wrote to memory of 3824 1912 e5742a6.exe 58 PID 1912 wrote to memory of 3916 1912 e5742a6.exe 59 PID 1912 wrote to memory of 3984 1912 e5742a6.exe 60 PID 1912 wrote to memory of 4068 1912 e5742a6.exe 61 PID 1912 wrote to memory of 3768 1912 e5742a6.exe 62 PID 1912 wrote to memory of 2144 1912 e5742a6.exe 64 PID 1912 wrote to memory of 4744 1912 e5742a6.exe 75 PID 1912 wrote to memory of 1720 1912 e5742a6.exe 80 PID 1912 wrote to memory of 1244 1912 e5742a6.exe 81 PID 1912 wrote to memory of 1244 1912 e5742a6.exe 81 PID 1244 wrote to memory of 640 1244 rundll32.exe 83 PID 1244 wrote to memory of 640 1244 rundll32.exe 83 PID 1244 wrote to memory of 640 1244 rundll32.exe 83 PID 1244 wrote to memory of 1512 1244 rundll32.exe 84 PID 1244 wrote to memory of 1512 1244 rundll32.exe 84 PID 1244 wrote to memory of 1512 1244 rundll32.exe 84 PID 1912 wrote to memory of 776 1912 e5742a6.exe 8 PID 1912 wrote to memory of 780 1912 e5742a6.exe 9 PID 1912 wrote to memory of 64 1912 e5742a6.exe 13 PID 1912 wrote to memory of 2552 1912 e5742a6.exe 42 PID 1912 wrote to memory of 2560 1912 e5742a6.exe 43 PID 1912 wrote to memory of 2672 1912 e5742a6.exe 46 PID 1912 wrote to memory of 3528 1912 e5742a6.exe 56 PID 1912 wrote to memory of 3636 1912 e5742a6.exe 57 PID 1912 wrote to memory of 3824 1912 e5742a6.exe 58 PID 1912 wrote to memory of 3916 1912 e5742a6.exe 59 PID 1912 wrote to memory of 3984 1912 e5742a6.exe 60 PID 1912 wrote to memory of 4068 1912 e5742a6.exe 61 PID 1912 wrote to memory of 3768 1912 e5742a6.exe 62 PID 1912 wrote to memory of 2144 1912 e5742a6.exe 64 PID 1912 wrote to memory of 4744 1912 e5742a6.exe 75 PID 1912 wrote to memory of 640 1912 e5742a6.exe 83 PID 1912 wrote to memory of 640 1912 e5742a6.exe 83 PID 1912 wrote to memory of 1512 1912 e5742a6.exe 84 PID 1912 wrote to memory of 1512 1912 e5742a6.exe 84 PID 640 wrote to memory of 776 640 e5743a0.exe 8 PID 640 wrote to memory of 780 640 e5743a0.exe 9 PID 640 wrote to memory of 64 640 e5743a0.exe 13 PID 640 wrote to memory of 2552 640 e5743a0.exe 42 PID 640 wrote to memory of 2560 640 e5743a0.exe 43 PID 640 wrote to memory of 2672 640 e5743a0.exe 46 PID 640 wrote to memory of 3528 640 e5743a0.exe 56 PID 640 wrote to memory of 3636 640 e5743a0.exe 57 PID 640 wrote to memory of 3824 640 e5743a0.exe 58 PID 640 wrote to memory of 3916 640 e5743a0.exe 59 PID 640 wrote to memory of 3984 640 e5743a0.exe 60 PID 640 wrote to memory of 4068 640 e5743a0.exe 61 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5743a0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e575e7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5742a6.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2552
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2560
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2672
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3528
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\467e8f459ee8630ed2157065235fbc782afa03a92ad8d92a06b7606ed8cbf9ce_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\467e8f459ee8630ed2157065235fbc782afa03a92ad8d92a06b7606ed8cbf9ce_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\e5742a6.exeC:\Users\Admin\AppData\Local\Temp\e5742a6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1912
-
-
C:\Users\Admin\AppData\Local\Temp\e5743a0.exeC:\Users\Admin\AppData\Local\Temp\e5743a0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:640
-
-
C:\Users\Admin\AppData\Local\Temp\e575e7b.exeC:\Users\Admin\AppData\Local\Temp\e575e7b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:1512
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3636
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3916
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3984
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4068
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3768
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2144
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4744
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\e5742a6.exe
- Size 97KB
- SHA256 4485f8d82f1aa8ce6fdd8feddbee7f5796d1bf34c3f680e15ebb30d496ae44b6
- MD5 fbeebdc270089fa4a5235dfc3e6c6a5e
- SHA1 516c779817d1de75254fbfc140702bfc5ea84bc4
- SHA512 6fbbd9fd32295739b752c69ffe9638717e29f1893b46594bb69adeb79c5d9c807dabf865934b464cb2cba300b185d30dc1123cda46bef856430f9768ea93eb04
- SSDEEP 1536:kHmOxkKmuZH/frpelx+RPr5/LHrLUko49WCJBKZjHTjaFOnOKdmo3xyRBnVR:kHm17uZH/TpW+NJV9zMTjaOO2mnVR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 d0ca2be8ca9df15a711768d169eb1c83a93c821c0752dfcc487b49b79e6b817b
- MD5 55195b07761925754481dded0ad0030c
- SHA1 32b14890788b5284caa6e008cd6bfe2462652256
- SHA512 cb1262e587059d3483ab70c0e6d06e3f0b57910e17389bbf2554ce136f987a00eec414860108d942d48f0cf80789de70b1e0581513e00134682c022d74982041
- MD5 SHA1 SHA512