49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe
Size

90KB
MD5

6f37a87b612fc6a8f99d71525dcc4510
SHA1

e1e2bc68d468f04e9d145ccbb410733c3ecc5ca1
SHA256

49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1
SHA512

21f2e2f6be267055789c0d1b67e5a8214911babdd5e7ecc2c01911b1ec0c873a708f1983659dffe9da9b34775dd0e58c5b2e1bb8f3d6a54ccb12b7a907cf1233
SSDEEP

768:Qvw9816vhKQLro34/wQRNrfrunMxVFA3b7glw:YEGh0o3l2unMxVS3Hg

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E79C0345-BB50-49e7-AF34-435A602D4285}	49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E79C0345-BB50-49e7-AF34-435A602D4285}\stubpath = "C:\\Windows\\{E79C0345-BB50-49e7-AF34-435A602D4285}.exe"	49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04C10465-E419-4637-8A0F-433D5197868B}	{9F1E34EF-E274-46bd-BA01-27D5682C004A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}\stubpath = "C:\\Windows\\{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe"	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}\stubpath = "C:\\Windows\\{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe"	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{102DD81A-D92E-45e6-AEB8-50D731F30EDE}	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F1E34EF-E274-46bd-BA01-27D5682C004A}\stubpath = "C:\\Windows\\{9F1E34EF-E274-46bd-BA01-27D5682C004A}.exe"	{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}\stubpath = "C:\\Windows\\{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe"	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}\stubpath = "C:\\Windows\\{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe"	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}\stubpath = "C:\\Windows\\{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe"	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}\stubpath = "C:\\Windows\\{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe"	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F1E34EF-E274-46bd-BA01-27D5682C004A}	{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04C10465-E419-4637-8A0F-433D5197868B}\stubpath = "C:\\Windows\\{04C10465-E419-4637-8A0F-433D5197868B}.exe"	{9F1E34EF-E274-46bd-BA01-27D5682C004A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}\stubpath = "C:\\Windows\\{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe"	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}\stubpath = "C:\\Windows\\{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe"	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{102DD81A-D92E-45e6-AEB8-50D731F30EDE}\stubpath = "C:\\Windows\\{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe"	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe

Executes dropped EXE 12 IoCs

pid	Process
4396	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe
3064	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe
864	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe
2136	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe
4508	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe
5092	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe
4660	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe
740	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe
1220	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe
4084	{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe
4528	{9F1E34EF-E274-46bd-BA01-27D5682C004A}.exe
2552	{04C10465-E419-4637-8A0F-433D5197868B}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{E79C0345-BB50-49e7-AF34-435A602D4285}.exe	49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe
File created	C:\Windows\{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe
File created	C:\Windows\{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe
File created	C:\Windows\{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe
File created	C:\Windows\{9F1E34EF-E274-46bd-BA01-27D5682C004A}.exe	{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe
File created	C:\Windows\{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe
File created	C:\Windows\{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe
File created	C:\Windows\{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe
File created	C:\Windows\{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe
File created	C:\Windows\{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe
File created	C:\Windows\{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe
File created	C:\Windows\{04C10465-E419-4637-8A0F-433D5197868B}.exe	{9F1E34EF-E274-46bd-BA01-27D5682C004A}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2292	49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	4396	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe
Token: SeIncBasePriorityPrivilege	3064	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe
Token: SeIncBasePriorityPrivilege	864	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe
Token: SeIncBasePriorityPrivilege	2136	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe
Token: SeIncBasePriorityPrivilege	4508	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe
Token: SeIncBasePriorityPrivilege	5092	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe
Token: SeIncBasePriorityPrivilege	4660	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe
Token: SeIncBasePriorityPrivilege	740	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe
Token: SeIncBasePriorityPrivilege	1220	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe
Token: SeIncBasePriorityPrivilege	4084	{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe
Token: SeIncBasePriorityPrivilege	4528	{9F1E34EF-E274-46bd-BA01-27D5682C004A}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 4396	2292	49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe	98
PID 2292 wrote to memory of 4396	2292	49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe	98
PID 2292 wrote to memory of 4396	2292	49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe	98
PID 2292 wrote to memory of 3208	2292	49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe	99
PID 2292 wrote to memory of 3208	2292	49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe	99
PID 2292 wrote to memory of 3208	2292	49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe	99
PID 4396 wrote to memory of 3064	4396	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe	100
PID 4396 wrote to memory of 3064	4396	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe	100
PID 4396 wrote to memory of 3064	4396	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe	100
PID 4396 wrote to memory of 1008	4396	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe	101
PID 4396 wrote to memory of 1008	4396	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe	101
PID 4396 wrote to memory of 1008	4396	{E79C0345-BB50-49e7-AF34-435A602D4285}.exe	101
PID 3064 wrote to memory of 864	3064	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe	105
PID 3064 wrote to memory of 864	3064	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe	105
PID 3064 wrote to memory of 864	3064	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe	105
PID 3064 wrote to memory of 764	3064	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe	106
PID 3064 wrote to memory of 764	3064	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe	106
PID 3064 wrote to memory of 764	3064	{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe	106
PID 864 wrote to memory of 2136	864	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe	107
PID 864 wrote to memory of 2136	864	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe	107
PID 864 wrote to memory of 2136	864	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe	107
PID 864 wrote to memory of 2656	864	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe	108
PID 864 wrote to memory of 2656	864	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe	108
PID 864 wrote to memory of 2656	864	{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe	108
PID 2136 wrote to memory of 4508	2136	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe	109
PID 2136 wrote to memory of 4508	2136	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe	109
PID 2136 wrote to memory of 4508	2136	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe	109
PID 2136 wrote to memory of 2988	2136	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe	110
PID 2136 wrote to memory of 2988	2136	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe	110
PID 2136 wrote to memory of 2988	2136	{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe	110
PID 4508 wrote to memory of 5092	4508	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe	112
PID 4508 wrote to memory of 5092	4508	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe	112
PID 4508 wrote to memory of 5092	4508	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe	112
PID 4508 wrote to memory of 2296	4508	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe	113
PID 4508 wrote to memory of 2296	4508	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe	113
PID 4508 wrote to memory of 2296	4508	{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe	113
PID 5092 wrote to memory of 4660	5092	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe	114
PID 5092 wrote to memory of 4660	5092	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe	114
PID 5092 wrote to memory of 4660	5092	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe	114
PID 5092 wrote to memory of 3496	5092	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe	115
PID 5092 wrote to memory of 3496	5092	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe	115
PID 5092 wrote to memory of 3496	5092	{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe	115
PID 4660 wrote to memory of 740	4660	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe	122
PID 4660 wrote to memory of 740	4660	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe	122
PID 4660 wrote to memory of 740	4660	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe	122
PID 4660 wrote to memory of 3900	4660	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe	123
PID 4660 wrote to memory of 3900	4660	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe	123
PID 4660 wrote to memory of 3900	4660	{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe	123
PID 740 wrote to memory of 1220	740	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe	124
PID 740 wrote to memory of 1220	740	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe	124
PID 740 wrote to memory of 1220	740	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe	124
PID 740 wrote to memory of 764	740	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe	125
PID 740 wrote to memory of 764	740	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe	125
PID 740 wrote to memory of 764	740	{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe	125
PID 1220 wrote to memory of 4084	1220	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe	126
PID 1220 wrote to memory of 4084	1220	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe	126
PID 1220 wrote to memory of 4084	1220	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe	126
PID 1220 wrote to memory of 3852	1220	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe	127
PID 1220 wrote to memory of 3852	1220	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe	127
PID 1220 wrote to memory of 3852	1220	{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe	127
PID 4084 wrote to memory of 4528	4084	{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe	128
PID 4084 wrote to memory of 4528	4084	{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe	128
PID 4084 wrote to memory of 4528	4084	{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe	128
PID 4084 wrote to memory of 4676	4084	{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe	129

C:\Users\Admin\AppData\Local\Temp\49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\49ff9d53a798c36bdc34c13bab7ef793febe7336626653b2e4adf8eacfe550a1_NeikiAnalytics.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\{E79C0345-BB50-49e7-AF34-435A602D4285}.exe
  C:\Windows\{E79C0345-BB50-49e7-AF34-435A602D4285}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe
    C:\Windows\{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe
      C:\Windows\{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:864
    - - C:\Windows\{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe
        
        C:\Windows\{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2136
      - C:\Windows\{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe
        
        C:\Windows\{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe
        
        C:\Windows\{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe
        
        C:\Windows\{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe
        
        C:\Windows\{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe
        
        C:\Windows\{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe
        
        C:\Windows\{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\{9F1E34EF-E274-46bd-BA01-27D5682C004A}.exe
        
        C:\Windows\{9F1E34EF-E274-46bd-BA01-27D5682C004A}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
        
        C:\Windows\{04C10465-E419-4637-8A0F-433D5197868B}.exe
        
        C:\Windows\{04C10465-E419-4637-8A0F-433D5197868B}.exe
        13⤵
        Executes dropped EXE
        
        PID:2552
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9F1E3~1.EXE > nul
        13⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{34CE1~1.EXE > nul
        12⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{102DD~1.EXE > nul
        11⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0F356~1.EXE > nul
        10⤵
        
        PID:764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{88F7F~1.EXE > nul
        9⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B32A5~1.EXE > nul
        8⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{45ABC~1.EXE > nul
        7⤵
        
        PID:2296
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B5B22~1.EXE > nul
        6⤵
        
        PID:2988
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1B0CB~1.EXE > nul
        5⤵
        
        PID:2656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B3743~1.EXE > nul
      4⤵
      PID:764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E79C0~1.EXE > nul
    3⤵
    PID:1008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\49FF9D~1.EXE > nul
  2⤵
  PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{04C10465-E419-4637-8A0F-433D5197868B}.exe

Filesize
90KB

MD5
fb4fa9c37f00b8b2edc68453a816630f

SHA1
de38730a8d4ddad83694311f2cc5c647e7dcf9e8

SHA256
24c6a9b9bbabcd1889bf8687b7301b4582824b157c4d2c46df36339539344e66

SHA512
a0e74892efade67caf0b8d96bf93c052b7ad9553c2dee6527ddebd840eded59515b904ef5f6cfdbf905d31784b839dc99bb01ec63cda4cad3b3190567c90dd3e

Download Submit
C:\Windows\{0F35641D-E48A-4c63-ABDC-B0CA45266CE4}.exe

Filesize
90KB

MD5
6a4766c608bb8f19b727f9a633cc7477

SHA1
2d840ec4c46469f6c43ebaf93e00b57d40a3cc7b

SHA256
10f9a39ab84753cf81ec3f719a5b5d49adb9eed375747f22f678e8443108ad85

SHA512
94e19fe58d30f7f792cc20cb46199bf0be468723e7bffd4b3acac835e437b160d2f50b93b6f050fd3aa9a1dbfa979d8082a2f7779a2b8f72a858e9417730d453

Download Submit
C:\Windows\{102DD81A-D92E-45e6-AEB8-50D731F30EDE}.exe

Filesize
90KB

MD5
48312ce2c4aa544819e0dfa56bef3c40

SHA1
46d66d9df683a74da61648bb826f43d8491965b6

SHA256
649dbe7d1c553cc489aa5ee92e638c11a11abf45679e1bfdcf9dde7bc728888a

SHA512
0839335c90db932485879f9bab06c0d25c04ed466812a581bb7ada4730a45371ec53c67a44ce4ab7945534caf52700d13a9b386de482de6df37851a517893026

Download Submit
C:\Windows\{1B0CB99A-4056-4a5d-A9FB-E900F2C0E286}.exe

Filesize
90KB

MD5
a08d9e7a0cff0e2b5f38582dca84511b

SHA1
8d21456b10e093aff1e0f170a8f03acbde6a0662

SHA256
64b4a9137d16ecac5d178c456f136e9cd1c230d18a5aac6c4cc02df02bbf6ff6

SHA512
f96d585657dabe9503e1fd216d0681ccee3cef581093ba78e361cfa38b4c92033bb51be3a00d3a8345703f1d3670d1465c270da8149479abb5248a40427f695a

Download Submit
C:\Windows\{34CE1BA8-8A94-4f33-BF20-F083BC032F7A}.exe

Filesize
90KB

MD5
1d24567b56c45328fbf00f05a3d66988

SHA1
9e52ce0e06e7b788e2602d6b4ca070043cdf2ceb

SHA256
0e178d4ea65e0326b991a094b5bd059577aec4d64d195910aff89f3dbdd14e8d

SHA512
384ef86a8dc7af769dbd96e6c2ba0d55d221b17cc82af21a9cf6d63aceee7526c039f4ce90637727710c70883b6bd31d9e5f9a817f53283de4779e94c6b3cd7d

Download Submit
C:\Windows\{45ABC542-56E1-4a29-A05C-1C4CC957BA8C}.exe

Filesize
90KB

MD5
3773afd0ee224e03356c27aad87cd504

SHA1
949641ff1b119f6d0a33ed7c8461416514b6bd97

SHA256
766159344754a16c6f291f919eb02d06b92a4880cde291d4c0a7b30f0e4be644

SHA512
ef4a9a89b64c5a428e60bfdf9606f0e528d8b49347f20c28ac5524a52def2c2bd97020c60429f43f9759d88b1389d23d6962e3241c96db2fbea12fd7973d71cc

Download Submit
C:\Windows\{88F7FEF1-88C0-4ab3-9BB7-9D35BED3E34D}.exe

Filesize
90KB

MD5
8268941b74c79e1f1b0cdd0da9b3a45c

SHA1
6186431d7ad26fb96f044dbb3e4580fb5941eb84

SHA256
cfaa8f6201ebc5e35460c4966fdf7168e556585e66fd3c4edeb3aa0875b05a9e

SHA512
e3e7ad80913e4a5f6534deec6bb0fb73a4747e94b0cc3ea10992696311ef824115bf6333b3bc4c71e264aac4b494e3d19429648d5c9ee6af94b7a2a6f39dc33a

Download Submit
C:\Windows\{9F1E34EF-E274-46bd-BA01-27D5682C004A}.exe

Filesize
90KB

MD5
88f45ad02a156710c6be046f674c3c3f

SHA1
b569adb4b007d0054ec08186f96257a6630754db

SHA256
34b4790e66d5a79a397ae63bfb27a8af33fccaa881ad10a1b371a24603e34bd3

SHA512
08107ecf046bc68ee1d159f908e81491a3aec170658cd10cbbceeb69b6aa6a2cf5a6ac3ca90a57c6b0578e4b414115fab60110159a41546f876ba40a557b181b

Download Submit
C:\Windows\{B32A5480-AD40-4bb2-9A78-BC8C0ACB1FCC}.exe

Filesize
90KB

MD5
fc0fceacb7cbb72570d286a1799af320

SHA1
37af6d2cf065638a70320cc3fa33443ebcdc9dc9

SHA256
6519a5bdf0fdb2dc8610fba9e749bab8ef649bba7409b23de8bd0b28881245fe

SHA512
9545c39fc613ee0820c01d0274b8f1d48905d4353c1d5971f1e7c75bc844dfba454206f6d00d2454794e582cee7b8179cd023816f54b79971fe1410f647c19ba

Download Submit
C:\Windows\{B37434B3-E5B1-46f6-ABAC-CF198B8AB607}.exe

Filesize
90KB

MD5
ae84dbc94f7ef52a126905e2988a4bc9

SHA1
210f2aa81f231b7cfbe0d7c962caab45850ab938

SHA256
01d265407a667cce3926016261eaf95979a47db9ae146c7ad654dfde79ef790b

SHA512
aa3d17b2ff3e42c501f28bde285de883d817d099f3d134a71369cff1225b619f4bb23b7869370e15a269986be02586084031449d29ca74e468f1687cb860ffbc

Download Submit
C:\Windows\{B5B22E4C-0BA7-4d42-A3E2-BE39C7F3CDD0}.exe

Filesize
90KB

MD5
3a3737f125da7479be1c7ade23aa3bb8

SHA1
7446f3305bbd48328bcea239ed939592f93aa3e2

SHA256
7240f2dc6e82118803e876fba9fe50bad3250fbb3c8475feb748b7cdd2ffb272

SHA512
7db37890f31d7622427192c602b73968ae1f727b0093e54db61e0bd61e4dd61e1724040a1c57d5b2de9c95bdb1993d4fa6c58e125e635915bf6489795b3ba9bb

Download Submit
C:\Windows\{E79C0345-BB50-49e7-AF34-435A602D4285}.exe

Filesize
90KB

MD5
253d486a170e581fdadd236a89824c69

SHA1
76efffaf3158d1330184ec4a2253451ff2997cfc

SHA256
d498c8541256417fe0249b480654417ebfd0a94d24b5f3656545bad151610fe9

SHA512
208fac05f745e7a1a39eabb095b6451f94d68cc5c8a914154747d56446b2fdfcd3b70d9074a0f90fc2bf19e8e856ae628c2bb6acfb27b91674b2158a1cdd30fe

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads