8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
Size

64KB
MD5

296b2695f926822e3315361984834550
SHA1

a72d2d0a12931f1c3ddc8027456b35f73525541f
SHA256

8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288
SHA512

d4acc5f95a8499728ddd1f303f2977849fec05b6791ff231c5761e46174cab2b93d333d791cc73af9b7eef6fffbc15a0619e98e841586dbff6d6b34c749997d8
SSDEEP

192:ObOzawOs81elJHsc45HcRZOgtSWcWaOT2QLrCqwTY04/CFxyNhoy5tm:ObLwOs8AHsc4pMfwIKQLro14/CFsrdm

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FC14F31-76BE-4b41-9AF0-B62F710633E6}\stubpath = "C:\\Windows\\{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe"	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC9913C4-BD50-4b06-A56F-198F7C0788F7}	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{511D2A13-1954-410b-B6BD-4B28F0BBE909}	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}\stubpath = "C:\\Windows\\{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe"	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12EA0277-D126-4227-B214-B67AEC9D928E}	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12EA0277-D126-4227-B214-B67AEC9D928E}\stubpath = "C:\\Windows\\{12EA0277-D126-4227-B214-B67AEC9D928E}.exe"	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{491D02D2-99C5-4b32-8827-0CB5B685EF2C}	{12EA0277-D126-4227-B214-B67AEC9D928E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22E924E8-0A26-459d-983A-53BFAB3EC4DB}\stubpath = "C:\\Windows\\{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe"	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48B90CA9-A50F-45eb-9865-3691EF684BA6}\stubpath = "C:\\Windows\\{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe"	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{412066B0-8823-46cf-AD40-9F26A064DEE1}	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15B40476-E596-4afc-AEE5-68F40E7FC76D}	{491D02D2-99C5-4b32-8827-0CB5B685EF2C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{15B40476-E596-4afc-AEE5-68F40E7FC76D}\stubpath = "C:\\Windows\\{15B40476-E596-4afc-AEE5-68F40E7FC76D}.exe"	{491D02D2-99C5-4b32-8827-0CB5B685EF2C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{446D4F1E-79BD-493f-A962-63DDA536F3C8}\stubpath = "C:\\Windows\\{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe"	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C482446F-C7DF-4e63-858C-3AA14F468925}	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C482446F-C7DF-4e63-858C-3AA14F468925}\stubpath = "C:\\Windows\\{C482446F-C7DF-4e63-858C-3AA14F468925}.exe"	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{412066B0-8823-46cf-AD40-9F26A064DEE1}\stubpath = "C:\\Windows\\{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe"	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{491D02D2-99C5-4b32-8827-0CB5B685EF2C}\stubpath = "C:\\Windows\\{491D02D2-99C5-4b32-8827-0CB5B685EF2C}.exe"	{12EA0277-D126-4227-B214-B67AEC9D928E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22E924E8-0A26-459d-983A-53BFAB3EC4DB}	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5FC14F31-76BE-4b41-9AF0-B62F710633E6}	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{446D4F1E-79BD-493f-A962-63DDA536F3C8}	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC9913C4-BD50-4b06-A56F-198F7C0788F7}\stubpath = "C:\\Windows\\{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe"	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{511D2A13-1954-410b-B6BD-4B28F0BBE909}\stubpath = "C:\\Windows\\{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe"	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{48B90CA9-A50F-45eb-9865-3691EF684BA6}	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe

Executes dropped EXE 12 IoCs

pid	Process
2084	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe
2788	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe
1832	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe
4744	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe
3448	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe
4324	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe
1380	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe
3480	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe
1132	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe
2280	{12EA0277-D126-4227-B214-B67AEC9D928E}.exe
3012	{491D02D2-99C5-4b32-8827-0CB5B685EF2C}.exe
3096	{15B40476-E596-4afc-AEE5-68F40E7FC76D}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
File created	C:\Windows\{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe
File created	C:\Windows\{12EA0277-D126-4227-B214-B67AEC9D928E}.exe	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe
File created	C:\Windows\{15B40476-E596-4afc-AEE5-68F40E7FC76D}.exe	{491D02D2-99C5-4b32-8827-0CB5B685EF2C}.exe
File created	C:\Windows\{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe
File created	C:\Windows\{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe
File created	C:\Windows\{491D02D2-99C5-4b32-8827-0CB5B685EF2C}.exe	{12EA0277-D126-4227-B214-B67AEC9D928E}.exe
File created	C:\Windows\{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe
File created	C:\Windows\{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe
File created	C:\Windows\{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe
File created	C:\Windows\{C482446F-C7DF-4e63-858C-3AA14F468925}.exe	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe
File created	C:\Windows\{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1624	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	2084	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe
Token: SeIncBasePriorityPrivilege	2788	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe
Token: SeIncBasePriorityPrivilege	1832	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe
Token: SeIncBasePriorityPrivilege	4744	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe
Token: SeIncBasePriorityPrivilege	3448	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe
Token: SeIncBasePriorityPrivilege	4324	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe
Token: SeIncBasePriorityPrivilege	1380	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe
Token: SeIncBasePriorityPrivilege	3480	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe
Token: SeIncBasePriorityPrivilege	1132	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe
Token: SeIncBasePriorityPrivilege	2280	{12EA0277-D126-4227-B214-B67AEC9D928E}.exe
Token: SeIncBasePriorityPrivilege	3012	{491D02D2-99C5-4b32-8827-0CB5B685EF2C}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2084	1624	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	97
PID 1624 wrote to memory of 2084	1624	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	97
PID 1624 wrote to memory of 2084	1624	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	97
PID 1624 wrote to memory of 2344	1624	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	98
PID 1624 wrote to memory of 2344	1624	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	98
PID 1624 wrote to memory of 2344	1624	8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe	98
PID 2084 wrote to memory of 2788	2084	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe	99
PID 2084 wrote to memory of 2788	2084	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe	99
PID 2084 wrote to memory of 2788	2084	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe	99
PID 2084 wrote to memory of 2052	2084	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe	100
PID 2084 wrote to memory of 2052	2084	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe	100
PID 2084 wrote to memory of 2052	2084	{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe	100
PID 2788 wrote to memory of 1832	2788	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe	103
PID 2788 wrote to memory of 1832	2788	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe	103
PID 2788 wrote to memory of 1832	2788	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe	103
PID 2788 wrote to memory of 4012	2788	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe	104
PID 2788 wrote to memory of 4012	2788	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe	104
PID 2788 wrote to memory of 4012	2788	{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe	104
PID 1832 wrote to memory of 4744	1832	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe	105
PID 1832 wrote to memory of 4744	1832	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe	105
PID 1832 wrote to memory of 4744	1832	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe	105
PID 1832 wrote to memory of 396	1832	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe	106
PID 1832 wrote to memory of 396	1832	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe	106
PID 1832 wrote to memory of 396	1832	{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe	106
PID 4744 wrote to memory of 3448	4744	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe	107
PID 4744 wrote to memory of 3448	4744	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe	107
PID 4744 wrote to memory of 3448	4744	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe	107
PID 4744 wrote to memory of 2176	4744	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe	108
PID 4744 wrote to memory of 2176	4744	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe	108
PID 4744 wrote to memory of 2176	4744	{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe	108
PID 3448 wrote to memory of 4324	3448	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe	109
PID 3448 wrote to memory of 4324	3448	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe	109
PID 3448 wrote to memory of 4324	3448	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe	109
PID 3448 wrote to memory of 2448	3448	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe	110
PID 3448 wrote to memory of 2448	3448	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe	110
PID 3448 wrote to memory of 2448	3448	{C482446F-C7DF-4e63-858C-3AA14F468925}.exe	110
PID 4324 wrote to memory of 1380	4324	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe	111
PID 4324 wrote to memory of 1380	4324	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe	111
PID 4324 wrote to memory of 1380	4324	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe	111
PID 4324 wrote to memory of 1064	4324	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe	112
PID 4324 wrote to memory of 1064	4324	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe	112
PID 4324 wrote to memory of 1064	4324	{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe	112
PID 1380 wrote to memory of 3480	1380	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe	113
PID 1380 wrote to memory of 3480	1380	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe	113
PID 1380 wrote to memory of 3480	1380	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe	113
PID 1380 wrote to memory of 2588	1380	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe	114
PID 1380 wrote to memory of 2588	1380	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe	114
PID 1380 wrote to memory of 2588	1380	{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe	114
PID 3480 wrote to memory of 1132	3480	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe	115
PID 3480 wrote to memory of 1132	3480	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe	115
PID 3480 wrote to memory of 1132	3480	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe	115
PID 3480 wrote to memory of 3644	3480	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe	116
PID 3480 wrote to memory of 3644	3480	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe	116
PID 3480 wrote to memory of 3644	3480	{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe	116
PID 1132 wrote to memory of 2280	1132	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe	117
PID 1132 wrote to memory of 2280	1132	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe	117
PID 1132 wrote to memory of 2280	1132	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe	117
PID 1132 wrote to memory of 4700	1132	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe	118
PID 1132 wrote to memory of 4700	1132	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe	118
PID 1132 wrote to memory of 4700	1132	{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe	118
PID 2280 wrote to memory of 3012	2280	{12EA0277-D126-4227-B214-B67AEC9D928E}.exe	119
PID 2280 wrote to memory of 3012	2280	{12EA0277-D126-4227-B214-B67AEC9D928E}.exe	119
PID 2280 wrote to memory of 3012	2280	{12EA0277-D126-4227-B214-B67AEC9D928E}.exe	119
PID 2280 wrote to memory of 3544	2280	{12EA0277-D126-4227-B214-B67AEC9D928E}.exe	120

C:\Users\Admin\AppData\Local\Temp\8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8c2408a9d7e4ceaf77f2c72f61e533a535e39732b6c3d5be55455b3c52c49288_NeikiAnalytics.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe
  C:\Windows\{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe
    C:\Windows\{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe
      C:\Windows\{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\Windows\{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe
        
        C:\Windows\{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4744
      - C:\Windows\{C482446F-C7DF-4e63-858C-3AA14F468925}.exe
        
        C:\Windows\{C482446F-C7DF-4e63-858C-3AA14F468925}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Windows\{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe
        
        C:\Windows\{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe
        
        C:\Windows\{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1380
        
        C:\Windows\{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe
        
        C:\Windows\{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe
        
        C:\Windows\{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\{12EA0277-D126-4227-B214-B67AEC9D928E}.exe
        
        C:\Windows\{12EA0277-D126-4227-B214-B67AEC9D928E}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\{491D02D2-99C5-4b32-8827-0CB5B685EF2C}.exe
        
        C:\Windows\{491D02D2-99C5-4b32-8827-0CB5B685EF2C}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
        
        C:\Windows\{15B40476-E596-4afc-AEE5-68F40E7FC76D}.exe
        
        C:\Windows\{15B40476-E596-4afc-AEE5-68F40E7FC76D}.exe
        13⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{491D0~1.EXE > nul
        13⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12EA0~1.EXE > nul
        12⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{41206~1.EXE > nul
        11⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CC7DE~1.EXE > nul
        10⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{48B90~1.EXE > nul
        9⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{511D2~1.EXE > nul
        8⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C4824~1.EXE > nul
        7⤵
        
        PID:2448
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DC991~1.EXE > nul
        6⤵
        
        PID:2176
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{446D4~1.EXE > nul
        5⤵
        
        PID:396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5FC14~1.EXE > nul
      4⤵
      PID:4012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{22E92~1.EXE > nul
    3⤵
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\8C2408~1.EXE > nul
  2⤵
  PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{12EA0277-D126-4227-B214-B67AEC9D928E}.exe

Filesize
64KB

MD5
ff8b997e4c0f7c5f1900f7a53829da39

SHA1
9ae96215ea51cc8c37e560b6beb6f29f3acd614d

SHA256
c8b78de6cdb07c9af9b0e6cdbf15fb6a3560313df89a22032c21305a32b4cf3f

SHA512
b37b138678ad05991dd60197490fd773ccac324e659788534292232a287913e5a51bbe37038a7317d07bbcbd3dadaf27d3958167b90e6407081b3e7ba24cf65e

Download Submit
C:\Windows\{15B40476-E596-4afc-AEE5-68F40E7FC76D}.exe

Filesize
64KB

MD5
3e0ed4df9c24541160c9a46340559351

SHA1
7b094fe8fe75234b94dde0cdaaf5dd1ce6726974

SHA256
1119452ee20c9f5e39138c00d6756fa58d7d61e8f426cf3ce75d44e2a3e1d98e

SHA512
b0da024e2d907978bcbbf836e532152912b00b44fa49d5a36c9bd1c754eb843701bdfc3465dae1ffe138197f83b74fd33fc440c15e914d0444b14ba2ddc0c9ea

Download Submit
C:\Windows\{22E924E8-0A26-459d-983A-53BFAB3EC4DB}.exe

Filesize
64KB

MD5
f83d805c86093189fd505262e8d70cf4

SHA1
9e3d7579d0e8a9ccd506fb187dfa68455ae95caa

SHA256
22533f4b215a057fe66ca924c10b6a0931bbe23465c0b731ed8be02cb60f29c3

SHA512
f514bbfffee3ca6bde77819391aa186f660e909a31ca152b13d3e78f57a4f1cd992ca7426c47f25a51721aa9e2d6799c18f2baca6245c248e21b85b893fc3cbc

Download Submit
C:\Windows\{412066B0-8823-46cf-AD40-9F26A064DEE1}.exe

Filesize
64KB

MD5
be5c04005998e49883307e66b8f5d277

SHA1
6fbb9d70938d1656b0caa721faf08b07bb54527c

SHA256
a3cef8341bd489d9589bc47ab3d5105bb056352e30ab3451524048ebac693ef1

SHA512
a9ef99595dffa7ddc35a1ee48e94e9592d9fe03cf13f0c0e540dc2bb8f833876f6df628a0259a35f2b0d7b7fbffe3c9755afec9100af856ebeeb18f0c274743a

Download Submit
C:\Windows\{446D4F1E-79BD-493f-A962-63DDA536F3C8}.exe

Filesize
64KB

MD5
99f2df064be53a18738230451e5e969f

SHA1
702baf86ede9e1ba0c62530b336be78b4e01753e

SHA256
ca75e1d6a7283ecafffc0dfd50ea658b808f1c50548615e527c105f125dc3180

SHA512
8d641a40adacf8f267d543b3f709dab5e80bbcea682f6e49b9ec17a6518f94cd4951309b0dd85e94e5df670b0ba1f80fa47e67f7e79e44cf49d1a4e5c8a9150b

Download Submit
C:\Windows\{48B90CA9-A50F-45eb-9865-3691EF684BA6}.exe

Filesize
64KB

MD5
9681c213f99b1aa15d0b95fa3d0b882c

SHA1
9a399bf29ada02ec333610d4bae53d308ec075ff

SHA256
409af83f9228acc2dffe51d8ec17ca89ed02312b6e336b29feeb98a8f3de2910

SHA512
d10290bc4ece588d4dadc2e117746b227d1dca157501973c6540ab48d9f93fd2ee07d0c11f369bf02346a13859ac9c240557af6a80711c0f9490f745749b151e

Download Submit
C:\Windows\{491D02D2-99C5-4b32-8827-0CB5B685EF2C}.exe

Filesize
64KB

MD5
dd25bd357c59c0a3c9aa6d6b7b37a524

SHA1
beedf23f9b0be58ac0d7ea7a52fd64cfe0885494

SHA256
57cff522fe2c6548ff6e6f6eb82b801acd4f2fa4be1263c27a1e230e76e40c00

SHA512
4409da9b02f60d6ff814fd78137cb06e3e366e71b425ac3d837fadaec5f47d1801b51ab528df2b9731967bcc425f329f3a4278aa9428b7a72c6c92ff03810913

Download Submit
C:\Windows\{511D2A13-1954-410b-B6BD-4B28F0BBE909}.exe

Filesize
64KB

MD5
27fa44a71c8438fd625f505fefb4f2b8

SHA1
4f4a6b2fe4c39b09ee6ae2fe2a0d19c727504be5

SHA256
89b9d5c006063d34fb23a5f47512469839ccc4523a9c958af2c1b3a55f3c081e

SHA512
41801c487d63cbfbc5810cfb18f85e39f5eb239e33dd9553dbf2115262a7dd90e3f97c3beed5c306504281505a907b02706c687628eca6ad23b4a7848f1dd7ae

Download Submit
C:\Windows\{5FC14F31-76BE-4b41-9AF0-B62F710633E6}.exe

Filesize
64KB

MD5
4a96aadaaa867514213e115717f1afb3

SHA1
7c923cf769108fbe8b436eca3119310e1c185d96

SHA256
065872b5a4b295bb58d3d876b29d08812efd26e76d2cf9b71aa47dcd129bd8ee

SHA512
142f4acb96d2cb588a635f3214e9040c452fcd169e981cae5321775e7bafba5ec504951b38e15367a37a7ea65f6294fd675573f5350690f670c76a8611fba746

Download Submit
C:\Windows\{C482446F-C7DF-4e63-858C-3AA14F468925}.exe

Filesize
64KB

MD5
faaf58ad31f643159ec156db202eee0c

SHA1
8ae4bfb7b4f147247f8d42c2cccf1f5786d4821d

SHA256
a7aa1df0c76beb08fc3c8f95174a22d08520c3416daac255d149a8992e5fea80

SHA512
8644bf6aded79ccd896d13c5e01340d133f512ee88dfe134c69534ae7ade1f513b99b30e375a760abb9110ae36758b3f3e9b8c1ee4513ed875a26dd8cc7ce9ba

Download Submit
C:\Windows\{CC7DED01-DC5F-4fe1-8E93-07C3B45B6D09}.exe

Filesize
64KB

MD5
3c688143b664ee775b9698dce7258599

SHA1
c461e5e4830665feee8f14ad2a7a7d92e88bd419

SHA256
eeaa099629fa5b342c89177e8dba90966bcbd865cb3dba4f70ba690b13e9f766

SHA512
e77dca258ca0d8cc4e4f1813f251f714d6e91e14bab3179bee89a8d6aade8141632062b0376d4bc3ff1336268f659b8e99ffd7634ddc2351acf25ace0f59e655

Download Submit
C:\Windows\{DC9913C4-BD50-4b06-A56F-198F7C0788F7}.exe

Filesize
64KB

MD5
ee7f9064d6f47f5cd466236de5af1d97

SHA1
9ce8e783b6f6d49c43abf1442eea8375d12dc2b5

SHA256
6dc83630c4fa0191d485074362dfc02c2d0bd9ba02beb6dae03cc7ade04de4f0

SHA512
988ce35e52aed49cf419b5f45fb68f7d56f3eabcb7a295fca31b893c003130695400a53aae356f52659a38e39272ec29925fd06f949b2352c038575580f3a7ef

Download Submit
memory/1132-58-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1132-53-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1380-41-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1380-44-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1624-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1624-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1832-22-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1832-17-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2084-11-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2084-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2280-63-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2280-59-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2788-15-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2788-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3012-65-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3012-69-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3096-71-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3448-34-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3448-29-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3480-52-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3480-46-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4324-39-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4744-24-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4744-28-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads