8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288

Analysis

max time kernel
144s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
Size

64KB
MD5

296b2695f926822e3315361984834550
SHA1

a72d2d0a12931f1c3ddc8027456b35f73525541f
SHA256

8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288
SHA512

d4acc5f95a8499728ddd1f303f2977849fec05b6791ff231c5761e46174cab2b93d333d791cc73af9b7eef6fffbc15a0619e98e841586dbff6d6b34c749997d8
SSDEEP

192:ObOzawOs81elJHsc45HcRZOgtSWcWaOT2QLrCqwTY04/CFxyNhoy5tm:ObLwOs8AHsc4pMfwIKQLro14/CFsrdm

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC04FD23-C5E4-4887-9937-7289C39424CF}	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{AC04FD23-C5E4-4887-9937-7289C39424CF}\stubpath = "C:\\Windows\\{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe"	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2311F75C-4E5F-4c89-9391-AB2DE362C059}\stubpath = "C:\\Windows\\{2311F75C-4E5F-4c89-9391-AB2DE362C059}.exe"	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}\stubpath = "C:\\Windows\\{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}.exe"	{2311F75C-4E5F-4c89-9391-AB2DE362C059}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BEC0E986-00C1-4286-9A8B-F145928ED984}	{35E0F113-3DC2-4580-8376-389792EA681C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}\stubpath = "C:\\Windows\\{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe"	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEFAC985-25DD-4fab-91F2-D4497D2840CF}\stubpath = "C:\\Windows\\{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe"	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2311F75C-4E5F-4c89-9391-AB2DE362C059}	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A4D139F-07A7-4f5e-8860-861551C2FDA6}\stubpath = "C:\\Windows\\{9A4D139F-07A7-4f5e-8860-861551C2FDA6}.exe"	{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D988174D-7852-419e-8EDD-AF6F91DBA218}	{9A4D139F-07A7-4f5e-8860-861551C2FDA6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{BEC0E986-00C1-4286-9A8B-F145928ED984}\stubpath = "C:\\Windows\\{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe"	{35E0F113-3DC2-4580-8376-389792EA681C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D988174D-7852-419e-8EDD-AF6F91DBA218}\stubpath = "C:\\Windows\\{D988174D-7852-419e-8EDD-AF6F91DBA218}.exe"	{9A4D139F-07A7-4f5e-8860-861551C2FDA6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{35E0F113-3DC2-4580-8376-389792EA681C}\stubpath = "C:\\Windows\\{35E0F113-3DC2-4580-8376-389792EA681C}.exe"	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}\stubpath = "C:\\Windows\\{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe"	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DEFAC985-25DD-4fab-91F2-D4497D2840CF}	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}	{2311F75C-4E5F-4c89-9391-AB2DE362C059}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{35E0F113-3DC2-4580-8376-389792EA681C}	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9A4D139F-07A7-4f5e-8860-861551C2FDA6}	{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}\stubpath = "C:\\Windows\\{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe"	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe

Deletes itself 1 IoCs

pid	Process
2676	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
2184	{35E0F113-3DC2-4580-8376-389792EA681C}.exe
2288	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe
2528	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe
2248	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe
2984	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe
316	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe
292	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe
1940	{2311F75C-4E5F-4c89-9391-AB2DE362C059}.exe
1848	{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}.exe
788	{9A4D139F-07A7-4f5e-8860-861551C2FDA6}.exe
1612	{D988174D-7852-419e-8EDD-AF6F91DBA218}.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe	{35E0F113-3DC2-4580-8376-389792EA681C}.exe
File created	C:\Windows\{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe
File created	C:\Windows\{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe
File created	C:\Windows\{2311F75C-4E5F-4c89-9391-AB2DE362C059}.exe	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe
File created	C:\Windows\{D988174D-7852-419e-8EDD-AF6F91DBA218}.exe	{9A4D139F-07A7-4f5e-8860-861551C2FDA6}.exe
File created	C:\Windows\{9A4D139F-07A7-4f5e-8860-861551C2FDA6}.exe	{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}.exe
File created	C:\Windows\{35E0F113-3DC2-4580-8376-389792EA681C}.exe	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
File created	C:\Windows\{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe
File created	C:\Windows\{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe
File created	C:\Windows\{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe
File created	C:\Windows\{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}.exe	{2311F75C-4E5F-4c89-9391-AB2DE362C059}.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2212	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	2184	{35E0F113-3DC2-4580-8376-389792EA681C}.exe
Token: SeIncBasePriorityPrivilege	2288	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe
Token: SeIncBasePriorityPrivilege	2528	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe
Token: SeIncBasePriorityPrivilege	2248	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe
Token: SeIncBasePriorityPrivilege	2984	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe
Token: SeIncBasePriorityPrivilege	316	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe
Token: SeIncBasePriorityPrivilege	292	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe
Token: SeIncBasePriorityPrivilege	1940	{2311F75C-4E5F-4c89-9391-AB2DE362C059}.exe
Token: SeIncBasePriorityPrivilege	1848	{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}.exe
Token: SeIncBasePriorityPrivilege	788	{9A4D139F-07A7-4f5e-8860-861551C2FDA6}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2184	2212	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	28
PID 2212 wrote to memory of 2184	2212	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	28
PID 2212 wrote to memory of 2184	2212	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	28
PID 2212 wrote to memory of 2184	2212	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	28
PID 2212 wrote to memory of 2676	2212	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	29
PID 2212 wrote to memory of 2676	2212	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	29
PID 2212 wrote to memory of 2676	2212	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	29
PID 2212 wrote to memory of 2676	2212	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	29
PID 2184 wrote to memory of 2288	2184	{35E0F113-3DC2-4580-8376-389792EA681C}.exe	30
PID 2184 wrote to memory of 2288	2184	{35E0F113-3DC2-4580-8376-389792EA681C}.exe	30
PID 2184 wrote to memory of 2288	2184	{35E0F113-3DC2-4580-8376-389792EA681C}.exe	30
PID 2184 wrote to memory of 2288	2184	{35E0F113-3DC2-4580-8376-389792EA681C}.exe	30
PID 2184 wrote to memory of 2636	2184	{35E0F113-3DC2-4580-8376-389792EA681C}.exe	31
PID 2184 wrote to memory of 2636	2184	{35E0F113-3DC2-4580-8376-389792EA681C}.exe	31
PID 2184 wrote to memory of 2636	2184	{35E0F113-3DC2-4580-8376-389792EA681C}.exe	31
PID 2184 wrote to memory of 2636	2184	{35E0F113-3DC2-4580-8376-389792EA681C}.exe	31
PID 2288 wrote to memory of 2528	2288	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe	32
PID 2288 wrote to memory of 2528	2288	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe	32
PID 2288 wrote to memory of 2528	2288	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe	32
PID 2288 wrote to memory of 2528	2288	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe	32
PID 2288 wrote to memory of 2832	2288	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe	33
PID 2288 wrote to memory of 2832	2288	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe	33
PID 2288 wrote to memory of 2832	2288	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe	33
PID 2288 wrote to memory of 2832	2288	{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe	33
PID 2528 wrote to memory of 2248	2528	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe	36
PID 2528 wrote to memory of 2248	2528	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe	36
PID 2528 wrote to memory of 2248	2528	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe	36
PID 2528 wrote to memory of 2248	2528	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe	36
PID 2528 wrote to memory of 1944	2528	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe	37
PID 2528 wrote to memory of 1944	2528	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe	37
PID 2528 wrote to memory of 1944	2528	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe	37
PID 2528 wrote to memory of 1944	2528	{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe	37
PID 2248 wrote to memory of 2984	2248	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe	38
PID 2248 wrote to memory of 2984	2248	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe	38
PID 2248 wrote to memory of 2984	2248	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe	38
PID 2248 wrote to memory of 2984	2248	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe	38
PID 2248 wrote to memory of 2168	2248	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe	39
PID 2248 wrote to memory of 2168	2248	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe	39
PID 2248 wrote to memory of 2168	2248	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe	39
PID 2248 wrote to memory of 2168	2248	{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe	39
PID 2984 wrote to memory of 316	2984	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe	40
PID 2984 wrote to memory of 316	2984	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe	40
PID 2984 wrote to memory of 316	2984	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe	40
PID 2984 wrote to memory of 316	2984	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe	40
PID 2984 wrote to memory of 1348	2984	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe	41
PID 2984 wrote to memory of 1348	2984	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe	41
PID 2984 wrote to memory of 1348	2984	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe	41
PID 2984 wrote to memory of 1348	2984	{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe	41
PID 316 wrote to memory of 292	316	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe	42
PID 316 wrote to memory of 292	316	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe	42
PID 316 wrote to memory of 292	316	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe	42
PID 316 wrote to memory of 292	316	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe	42
PID 316 wrote to memory of 2784	316	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe	43
PID 316 wrote to memory of 2784	316	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe	43
PID 316 wrote to memory of 2784	316	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe	43
PID 316 wrote to memory of 2784	316	{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe	43
PID 292 wrote to memory of 1940	292	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe	44
PID 292 wrote to memory of 1940	292	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe	44
PID 292 wrote to memory of 1940	292	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe	44
PID 292 wrote to memory of 1940	292	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe	44
PID 292 wrote to memory of 2040	292	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe	45
PID 292 wrote to memory of 2040	292	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe	45
PID 292 wrote to memory of 2040	292	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe	45
PID 292 wrote to memory of 2040	292	{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe	45

C:\Users\Admin\AppData\Local\Temp\8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\{35E0F113-3DC2-4580-8376-389792EA681C}.exe
  C:\Windows\{35E0F113-3DC2-4580-8376-389792EA681C}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe
    C:\Windows\{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Windows\{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe
      C:\Windows\{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2528
    - - C:\Windows\{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe
        
        C:\Windows\{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2248
      - C:\Windows\{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe
        
        C:\Windows\{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe
        
        C:\Windows\{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe
        
        C:\Windows\{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:292
        
        C:\Windows\{2311F75C-4E5F-4c89-9391-AB2DE362C059}.exe
        
        C:\Windows\{2311F75C-4E5F-4c89-9391-AB2DE362C059}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}.exe
        
        C:\Windows\{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
        
        C:\Windows\{9A4D139F-07A7-4f5e-8860-861551C2FDA6}.exe
        
        C:\Windows\{9A4D139F-07A7-4f5e-8860-861551C2FDA6}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:788
        
        C:\Windows\{D988174D-7852-419e-8EDD-AF6F91DBA218}.exe
        
        C:\Windows\{D988174D-7852-419e-8EDD-AF6F91DBA218}.exe
        12⤵
        Executes dropped EXE
        
        PID:1612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9A4D1~1.EXE > nul
        12⤵
        
        PID:628
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D7F58~1.EXE > nul
        11⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2311F~1.EXE > nul
        10⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DEFAC~1.EXE > nul
        9⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FD03D~1.EXE > nul
        8⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{AC04F~1.EXE > nul
        7⤵
        
        PID:1348
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{14660~1.EXE > nul
        6⤵
        
        PID:2168
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C5F09~1.EXE > nul
        5⤵
        
        PID:1944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BEC0E~1.EXE > nul
      4⤵
      PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{35E0F~1.EXE > nul
    3⤵
    PID:2636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\8C2408~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{14660EEF-257A-4622-A1C3-0C6ECE5C94AC}.exe

Filesize
64KB

MD5
c47af4b86e9f7b0b34c2b33b31fa5f34

SHA1
7c529dd3d7e78dbc9c82f29194abe7f072c3dc2d

SHA256
d9cf87a5fe8ba207a65ef6e6d41a0bd9ce943c61bd66f2872ea953c670f01eec

SHA512
418c9687fa0f269e0ef07772772a402939473af5b561bb5209c1cd6fb1608a115e82673472dc901d901a6f2b064d46cf0235105a76f4c9af977508ef3553d33f

Download Submit
C:\Windows\{2311F75C-4E5F-4c89-9391-AB2DE362C059}.exe

Filesize
64KB

MD5
3506faf0bfd0d2e9facbee8e0bae0753

SHA1
c0198f00880f7689c6f01b900213407c2eca5310

SHA256
069df70bd549e4656893c4b101002216eb3952f028bc9772dfcc5e9425e27922

SHA512
7b3de013d3069fc5c8ea0792392610f0c415b220194465fa3f7a5b14f9f2e4cf2522ac1b26825d789048630760f9f87b90ff164850d48bda84440acc03679fc8

Download Submit
C:\Windows\{35E0F113-3DC2-4580-8376-389792EA681C}.exe

Filesize
64KB

MD5
f5c209bb2dcd15af928b87c7249cca83

SHA1
d2e93c0623394b5959b682d6660b5c7096078a87

SHA256
59edf63040c90aec8ff0e4c0d08c688d69bfcbcde47413429590020763438846

SHA512
dd65cce2242d2bd6769f19b6842aeef3e5204247e0d809a01a78e46b9df90be8b57a6328c7f2fe9f5eafbebf9b9ee8a256c0843f82d541ee93747d02126687f9

Download Submit
C:\Windows\{9A4D139F-07A7-4f5e-8860-861551C2FDA6}.exe

Filesize
64KB

MD5
32fd8c8bc5862b2fe319b21e6df503f5

SHA1
06a64150e8dbfdd72393ddd31ccd34a53da9bad5

SHA256
ab11a75b4744301db4a296da0386e696233a0e7bd1a4bad4b9c2c0d3c7bf60fd

SHA512
4d0b206028ee3ddcd91cc48a6e49c3cf89d6f156e0bc859bd1cd6456e1c143fe2eb8c30ef4d9df34583056bef3db538ed5f0c8af87be2f39562f0b020408cbb9

Download Submit
C:\Windows\{AC04FD23-C5E4-4887-9937-7289C39424CF}.exe

Filesize
64KB

MD5
86b030501c26065f91d7bca4818707c0

SHA1
00d4412e2d40fef46f9b4a93ef595b212445cf44

SHA256
332abdc9cb8b2b7fcd15e7d2bf65257148a4d0d9904fae5041be8899f122dda1

SHA512
2dc5d03ed216a56dbf4cd88f5aa044ea612a595d3ecc5379e4ed1f16d9a9179bc33d47a727cfd39848ba2921021ff61eaaab267710b01d09aca7157a5efdde45

Download Submit
C:\Windows\{BEC0E986-00C1-4286-9A8B-F145928ED984}.exe

Filesize
64KB

MD5
7c8dba990b4bc126be0127fcee36325b

SHA1
63d726d446c3cc31512da4b3977325fb03043f06

SHA256
a39ac18a01054cab7dc71f633ed7ac9e45b001163574a814d22cd9b6971adafa

SHA512
c9cc81a76aecb73b93adf57e93bc57b4ba69a292809e395958e95dcde9a4620758479709219331b77bfe28363edd16d82fc8af2b671864749f7e2e1919b1e80d

Download Submit
C:\Windows\{C5F092B8-C9CE-4c0a-A05F-A1D17D5310C0}.exe

Filesize
64KB

MD5
fca6de97c6f8d7d241e3f20b3637cd06

SHA1
cfb74a7a95fa123e3f2d68484d627d66e1e4f1a8

SHA256
9d0ab3662db548f148f4fe53d46bff0885f358cdc0095320d9ffebfc923494a2

SHA512
6491429df33df3c21455000aea38fd0a56341b830d062bd91a5ff522cc8293e2a370c6c64219a51b23cb6f42c7b98b6041377f8d15da15ca9d28d40f23176039

Download Submit
C:\Windows\{D7F581BA-C45D-402a-AFB9-BFD2AEF36C23}.exe

Filesize
64KB

MD5
c21591790d037d75b6c880633776c75c

SHA1
e4c653b6ea05dac5225a520b9ac30b5587b0e4f5

SHA256
3d45a4a62cfdafa2f88672a3c15f7b427692c2324ff0e6671159038e118291fe

SHA512
d248886485b9eb1ad534919e98fe37dab698eb01747d421d46502cf9d6f6e9923a832be95683673c6e0782cd74f9a24b1ed22d4e4a2394daa82d5543f3bcbf95

Download Submit
C:\Windows\{D988174D-7852-419e-8EDD-AF6F91DBA218}.exe

Filesize
64KB

MD5
0a892311a1d4106893c712560cfa61be

SHA1
2d00d3ae74f7c82ffae42f22f1b25fa3ff9e0f9f

SHA256
fe1741ce3aa335e2d3dbe0c433909e1faf4894c3f1f8f5ba9f94a7f8468483e0

SHA512
99ef3a7e0665fadbe8d115b5050809fb7f35978f31bb1d7a60d0a633aa5c14513e61e063a0aea896b4fa29c20529d065020a303a61fc1a51ad376caf1ddce122

Download Submit
C:\Windows\{DEFAC985-25DD-4fab-91F2-D4497D2840CF}.exe

Filesize
64KB

MD5
ed41a94e11dd5fe712f2bb13de748f9e

SHA1
91d045d422cb31e770b240c4a00ac6b6bd0ed5d9

SHA256
634f7d8ebf3aadbebe4c070ac20b93e005fdf07c694d1e3a9837341eb8b4bdd2

SHA512
d8f4d2743c5cf06735839c6b54534b426f1e75a8472a715a82033d79937bc060d44749ee4acd09c845f259f9a6a0b2cd36c18b7f0ee7fa08016e8472b5f63e06

Download Submit
C:\Windows\{FD03D7E7-DE6F-4c40-B6C7-C9DEA8536A0D}.exe

Filesize
64KB

MD5
c464a9678424aca67559444b9d9f6d12

SHA1
1c77a557f82ac080d75379380367d93f284928e8

SHA256
064a155f65b7888d3b8cbca1f0051dc882f7b0432fec335a0b1c4b0b3a105eb2

SHA512
e304b1f81ab4bc2273eefa5db37d9613876ae0bfb7b9fe0927cabbf94660d1ad756ddc5841600baf12051e790997d79a11aef7ffa3eef34f2317eb0a8ec38863

Download Submit
memory/292-61-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/292-68-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/316-59-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/788-95-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/788-87-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1848-85-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1940-70-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1940-77-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2184-16-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2184-8-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2212-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2212-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2212-3-0x00000000002C0000-0x00000000002D0000-memory.dmp

Filesize
64KB

Download
memory/2248-42-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2248-35-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2288-18-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2288-25-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2528-34-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2984-51-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2984-44-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads