Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/06/2024, 23:18
Static task
static1
Behavioral task
behavioral1
Sample
22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe
-
Size
320KB
-
MD5
322787fce3c3628b042cc40b173fbf20
-
SHA1
4fd9aa74c6030fecb7dd30ec7537a224e1d78e53
-
SHA256
22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215
-
SHA512
984a1fbb3e7d9570f6a8d8e4381a088d9374474b1887d688aa1c7c3d44f9c69e4da6e8bf9be48624f10ac143598ba53923781d3873d8af7ebc0508422413cb77
-
SSDEEP
6144:xTwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:JXgvmzFHi0mo5aH0qMzd5807FRPJQPDV
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" uapoajo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uapoajo.exe -
Adds policy Run key to start application 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqtggdwtmlhymjlklpjmz.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "wqtggdwtmlhymjlklpjmz.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "jaakhbrlbxqepjiecd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "haconjbxpniylhiggjce.exe" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "umnywridurlamhhedfx.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umnywridurlamhhedfx.exe" uapoajo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "aqpyuncvkfxkunlgd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqpyuncvkfxkunlgd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haconjbxpniylhiggjce.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaakhbrlbxqepjiecd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "haconjbxpniylhiggjce.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "wqtggdwtmlhymjlklpjmz.exe" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqtggdwtmlhymjlklpjmz.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaakhbrlbxqepjiecd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaakhbrlbxqepjiecd.exe" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "umnywridurlamhhedfx.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "jaakhbrlbxqepjiecd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "haconjbxpniylhiggjce.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqpyuncvkfxkunlgd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "aqpyuncvkfxkunlgd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oyrukxgtcrd = "wqtggdwtmlhymjlklpjmz.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jqggtdjt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umnywridurlamhhedfx.exe" uapoajo.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uapoajo.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uapoajo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe -
Executes dropped EXE 2 IoCs
pid Process 2236 uapoajo.exe 5036 uapoajo.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager uapoajo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys uapoajo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc uapoajo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power uapoajo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys uapoajo.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc uapoajo.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqtggdwtmlhymjlklpjmz.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "wqtggdwtmlhymjlklpjmz.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "jaakhbrlbxqepjiecd.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lwqulzjxhxks = "tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umnywridurlamhhedfx.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haconjbxpniylhiggjce.exe ." 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kwrwododoftci = "umnywridurlamhhedfx.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "wqtggdwtmlhymjlklpjmz.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umnywridurlamhhedfx.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lyuatjvlxpeovl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tigojbphvpgsbtqk.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "wqtggdwtmlhymjlklpjmz.exe ." 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqtggdwtmlhymjlklpjmz.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "umnywridurlamhhedfx.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "jaakhbrlbxqepjiecd.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lwqulzjxhxks = "jaakhbrlbxqepjiecd.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kwrwododoftci = "aqpyuncvkfxkunlgd.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haconjbxpniylhiggjce.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tigojbphvpgsbtqk.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "umnywridurlamhhedfx.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lyuatjvlxpeovl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tigojbphvpgsbtqk.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umnywridurlamhhedfx.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lwqulzjxhxks = "jaakhbrlbxqepjiecd.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqpyuncvkfxkunlgd.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lwqulzjxhxks = "wqtggdwtmlhymjlklpjmz.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqpyuncvkfxkunlgd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "aqpyuncvkfxkunlgd.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaakhbrlbxqepjiecd.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kwrwododoftci = "jaakhbrlbxqepjiecd.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lwqulzjxhxks = "wqtggdwtmlhymjlklpjmz.exe" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lyuatjvlxpeovl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqtggdwtmlhymjlklpjmz.exe ." 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aqpyuncvkfxkunlgd.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaakhbrlbxqepjiecd.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kwrwododoftci = "wqtggdwtmlhymjlklpjmz.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kwrwododoftci = "haconjbxpniylhiggjce.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaakhbrlbxqepjiecd.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lyuatjvlxpeovl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqtggdwtmlhymjlklpjmz.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "haconjbxpniylhiggjce.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kwrwododoftci = "jaakhbrlbxqepjiecd.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "tigojbphvpgsbtqk.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lyuatjvlxpeovl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umnywridurlamhhedfx.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaakhbrlbxqepjiecd.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "jaakhbrlbxqepjiecd.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kwrwododoftci = "wqtggdwtmlhymjlklpjmz.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haconjbxpniylhiggjce.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lwqulzjxhxks = "tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqtggdwtmlhymjlklpjmz.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lwqulzjxhxks = "aqpyuncvkfxkunlgd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaakhbrlbxqepjiecd.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "umnywridurlamhhedfx.exe ." uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\umnywridurlamhhedfx.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "haconjbxpniylhiggjce.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haconjbxpniylhiggjce.exe" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oczgarevibrckbx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tigojbphvpgsbtqk.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kwrwododoftci = "tigojbphvpgsbtqk.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tcuwlxfrzn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haconjbxpniylhiggjce.exe ." uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lwqulzjxhxks = "wqtggdwtmlhymjlklpjmz.exe" uapoajo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aizaozgry = "jaakhbrlbxqepjiecd.exe" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lwqulzjxhxks = "aqpyuncvkfxkunlgd.exe" uapoajo.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kwrwododoftci = "jaakhbrlbxqepjiecd.exe ." 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uapoajo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uapoajo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 whatismyip.everdot.org 11 whatismyip.everdot.org 15 www.showmyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\ywduyzwxuxxsklruzhfmd.ifg uapoajo.exe File opened for modification C:\Windows\SysWOW64\tcuwlxfrznyehtkyohqikzltfnbmsvhy.cve uapoajo.exe File created C:\Windows\SysWOW64\tcuwlxfrznyehtkyohqikzltfnbmsvhy.cve uapoajo.exe File opened for modification C:\Windows\SysWOW64\ywduyzwxuxxsklruzhfmd.ifg uapoajo.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ywduyzwxuxxsklruzhfmd.ifg uapoajo.exe File created C:\Program Files (x86)\ywduyzwxuxxsklruzhfmd.ifg uapoajo.exe File opened for modification C:\Program Files (x86)\tcuwlxfrznyehtkyohqikzltfnbmsvhy.cve uapoajo.exe File created C:\Program Files (x86)\tcuwlxfrznyehtkyohqikzltfnbmsvhy.cve uapoajo.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\tcuwlxfrznyehtkyohqikzltfnbmsvhy.cve uapoajo.exe File created C:\Windows\tcuwlxfrznyehtkyohqikzltfnbmsvhy.cve uapoajo.exe File opened for modification C:\Windows\ywduyzwxuxxsklruzhfmd.ifg uapoajo.exe File created C:\Windows\ywduyzwxuxxsklruzhfmd.ifg uapoajo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings uapoajo.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings uapoajo.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe 2236 uapoajo.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5036 uapoajo.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2236 uapoajo.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2236 2056 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe 82 PID 2056 wrote to memory of 2236 2056 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe 82 PID 2056 wrote to memory of 2236 2056 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe 82 PID 2056 wrote to memory of 5036 2056 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe 83 PID 2056 wrote to memory of 5036 2056 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe 83 PID 2056 wrote to memory of 5036 2056 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe 83 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uapoajo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uapoajo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" uapoajo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uapoajo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" uapoajo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\22d420983456928941372e92d0fafe5e22b7e0de4f5f8fa1a7e18894147a3215_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\uapoajo.exe"C:\Users\Admin\AppData\Local\Temp\uapoajo.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2236
-
-
C:\Users\Admin\AppData\Local\Temp\uapoajo.exe"C:\Users\Admin\AppData\Local\Temp\uapoajo.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:5036
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3956
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720KB
MD5f14ec017fac3402fed9fc60b9e2559d9
SHA171ddfa7118d0511256181248d21f1a71887c6867
SHA256c5a50168ed1c7108bf16e484a5077da1d6dc23cdcbcb094689a5084e62aa27ff
SHA51288379745c41512071d19d6d41640fb3be4f8d8acf1f220a6f3a0c348d037af5d3a31bf0330e4bfd047b6fc1de60a5e1e70cd88533621934ff024c454b27d1618
-
Filesize
4KB
MD59e3f61f55d8b91f14e407e1dfcae0e9b
SHA1d9d59ebb75223baad7539c12f84bffe4def18739
SHA256b44ea9d36943272fded26afec06a3072c092407c7668ca854d0d5746581d5f5c
SHA512731080ae45d5d74790dca6d85058ae899e866d839e2cc8b95652a19f3ded5a340fb31741a2e61268398d6698219d759799348aeb88ed49c605079185796bb224
-
Filesize
280B
MD54444bca4d3e4c9cc982f15fba95f95a0
SHA113bbd9a740a19457bf1e9b68880e06722759facc
SHA25613cfaa76157912be7a06a4218021d5b8f14df9eb8160693f90dc1d070e89fd65
SHA512ed0f67fc035fac836ea9a93505a598526a00b1831ec771003cd87aefba988c94d0c1e908e9bd74a9d8369403470275f142c6b1e3be1c355336186a6b76b2a59b