6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4

Analysis

max time kernel
78s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
Size

232KB
MD5

e63363b5821c2d5a191a739c6a1656a0
SHA1

4446e08d4c95444d2f761a4737a3aa48485e7bb5
SHA256

6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4
SHA512

15b1a9b3e79966c1266efdc540189a219ec954b34672476aea806d5756d60a6a9e34dbb631bcca6fe33748487ca4e900607bd75cf729ec8a2e6d9ba0488303c2
SSDEEP

3072:s1i/NU8bOMYcYYcmy51VRgiFCpCIXUWOLTsEsigcL3P6xxc1VOz1i/NU82OMYcYU:ai/NjO5xbg/CSUFLTwMjs6oi/N+O7

Score

8^/10

defense_evasion persistence upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe"	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2168-0-0x0000000000400000-0x000000000043A000-memory.dmp	upx
behavioral2/files/0x000900000002340b-10.dat	upx
behavioral2/files/0x000700000002340f-11.dat	upx
behavioral2/memory/2168-12-0x0000000000400000-0x000000000043A000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2748	cmd.exe
2480	cmd.exe
3420	cmd.exe
4840	cmd.exe
1800	cmd.exe
3984	cmd.exe
4692	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\windows.exe	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
File opened for modification	C:\WINDOWS\windows.exe	attrib.exe
File created	C:\WINDOWS\windows.exe	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007bd2b5d2c6d91e4f8f2c8e8b7d41a41500000000020000000000106600000001000020000000367e4dc50ffa7de646264450e63240ce9d7d40b2b6cfffc84d94f33bfe674544000000000e800000000200002000000005b26848a39348785677ffa008cbeac30afbe96d40ceb3a2a3ae645fa8ae90a9200000001338f71c3e71524257234af64aef7af5f95a60f708add55a3639ba665942354e40000000af957c5dd715ee41f20a774e89ba1ea9c9f39a878daa2e6aa31937dea097f00108c8d2e6b23e12acbc0c35cea9bb2720f2e80a028ec43e73a70ccc3f47f3ddf4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0de3d4a0ac7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425486820"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{67732429-32FD-11EF-BCA5-62C35996CAED} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8054474a0ac7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007bd2b5d2c6d91e4f8f2c8e8b7d41a4150000000002000000000010660000000100002000000027456f6f05efc5a31614cd182b6495b61570010375b1b5fd3998aae15fcc5315000000000e800000000200002000000090ad05c68d4d36d225f39b8a2b5f951ff6d74661b08a1cea4ded3b176111eb8b2000000069bd3248e30b4016787c0d8b3b366ec207be909f3ddd71199394d0f506153ab040000000adfb16210c38db53b60e1605bd369383b89fbfd4400f659f0fdad0dbb3ffc9e80422fe24a382c0e2383a7d37e774166323478bf934d9d651ed37a6bce8c8cdc2	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
1856	iexplore.exe
1856	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 1856	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	81
PID 2168 wrote to memory of 1856	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	81
PID 1856 wrote to memory of 2500	1856	iexplore.exe	82
PID 1856 wrote to memory of 2500	1856	iexplore.exe	82
PID 1856 wrote to memory of 2500	1856	iexplore.exe	82
PID 2168 wrote to memory of 4840	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	83
PID 2168 wrote to memory of 4840	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	83
PID 2168 wrote to memory of 4840	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	83
PID 4840 wrote to memory of 1308	4840	cmd.exe	85
PID 4840 wrote to memory of 1308	4840	cmd.exe	85
PID 4840 wrote to memory of 1308	4840	cmd.exe	85
PID 2168 wrote to memory of 1800	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	86
PID 2168 wrote to memory of 1800	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	86
PID 2168 wrote to memory of 1800	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	86
PID 1800 wrote to memory of 3288	1800	cmd.exe	88
PID 1800 wrote to memory of 3288	1800	cmd.exe	88
PID 1800 wrote to memory of 3288	1800	cmd.exe	88
PID 2168 wrote to memory of 3984	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	89
PID 2168 wrote to memory of 3984	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	89
PID 2168 wrote to memory of 3984	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	89
PID 3984 wrote to memory of 4124	3984	cmd.exe	91
PID 3984 wrote to memory of 4124	3984	cmd.exe	91
PID 3984 wrote to memory of 4124	3984	cmd.exe	91
PID 2168 wrote to memory of 4692	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	92
PID 2168 wrote to memory of 4692	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	92
PID 2168 wrote to memory of 4692	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	92
PID 4692 wrote to memory of 4784	4692	cmd.exe	94
PID 4692 wrote to memory of 4784	4692	cmd.exe	94
PID 4692 wrote to memory of 4784	4692	cmd.exe	94
PID 2168 wrote to memory of 2748	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	95
PID 2168 wrote to memory of 2748	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	95
PID 2168 wrote to memory of 2748	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	95
PID 2748 wrote to memory of 1420	2748	cmd.exe	97
PID 2748 wrote to memory of 1420	2748	cmd.exe	97
PID 2748 wrote to memory of 1420	2748	cmd.exe	97
PID 2168 wrote to memory of 2480	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	98
PID 2168 wrote to memory of 2480	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	98
PID 2168 wrote to memory of 2480	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	98
PID 2480 wrote to memory of 5008	2480	cmd.exe	100
PID 2480 wrote to memory of 5008	2480	cmd.exe	100
PID 2480 wrote to memory of 5008	2480	cmd.exe	100
PID 2168 wrote to memory of 3420	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	101
PID 2168 wrote to memory of 3420	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	101
PID 2168 wrote to memory of 3420	2168	6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe	101
PID 3420 wrote to memory of 3604	3420	cmd.exe	103
PID 3420 wrote to memory of 3604	3420	cmd.exe	103
PID 3420 wrote to memory of 3604	3420	cmd.exe	103

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1420	attrib.exe
5008	attrib.exe
3604	attrib.exe
1308	attrib.exe
3288	attrib.exe
4124	attrib.exe
4784	attrib.exe

C:\Users\Admin\AppData\Local\Temp\6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a56db9007d57f13a80532d30ccb5ca2a0ca56553aa3cbbf995c7b2d37637aa4_NeikiAnalytics.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - Views/modifies file attributes
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - Views/modifies file attributes
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\WINDOWS\windows.exe"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "c:\system.exe"
    3⤵
    - Views/modifies file attributes
    PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\windows.exe

Filesize
232KB

MD5
17b2657c69964dd0f238a3201e8d35d6

SHA1
d6686c7abcb9b6e633af1b39d5b366b633fd99e8

SHA256
324e2982586d2398f3d334752d1d7dc607ceb0e7c9597d45fda8695b2ad33d1b

SHA512
e6cd16df2336b43576bf1560b85209ce36ae8214a9380d0fc9f61d3afb7edf9b1514f9cc24cfca7447b4228f7f8c6b50ed9d15b084c1b858457887650ef9971a

Download Submit
C:\system.exe

Filesize
232KB

MD5
13e54971750a22edacad34439450a3f3

SHA1
bf4f67d43109a3cbc165952ef3a6bb6d049983ef

SHA256
aa51ad5baaa08f597e19c9af40dd0972d7b3eba280ac01e0e5e08924ae376e1a

SHA512
c72c5c656c3674d184d06a899b2ee88652db0ed84d60e41877751ce547a1e000dc97c00942ecf543ee9585397e4cbb8fe0470dd89424553072774b05b3496505

Download Submit
memory/2168-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2168-12-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download