436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe
Size

90KB
MD5

7599eb90a5085483f75ac7a0c6599f20
SHA1

1193c5bbff60bd2d5a9ffc3371e8217c11faef8e
SHA256

436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c
SHA512

a6cc2080038e7dfa72e948def0b09c7dbbefe0d3a2e22f03403a4a2f116bc67fea4c94a2bcc274c63624dd4f57d83ab8a86eca11e583138f105098ee698a2ab3
SSDEEP

768:Qvw9816vhKQLroH4/wQRNrfrunMxVFA3b7glws:YEGh0oHl2unMxVS3Hgz

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20F0EB55-9508-4c10-997D-BFF021E5DBC2}	{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A1157CD-45D4-45e9-A540-383F7AAB6821}	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A1157CD-45D4-45e9-A540-383F7AAB6821}\stubpath = "C:\\Windows\\{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe"	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9828CC0-9B88-441b-B9A3-377147089A17}	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}\stubpath = "C:\\Windows\\{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe"	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{20F0EB55-9508-4c10-997D-BFF021E5DBC2}\stubpath = "C:\\Windows\\{20F0EB55-9508-4c10-997D-BFF021E5DBC2}.exe"	{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}	436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD476261-1E67-4517-BCC2-836B475AF573}\stubpath = "C:\\Windows\\{CD476261-1E67-4517-BCC2-836B475AF573}.exe"	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9319F59E-0909-4f39-B418-1CD6760555B2}	{CD476261-1E67-4517-BCC2-836B475AF573}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9319F59E-0909-4f39-B418-1CD6760555B2}\stubpath = "C:\\Windows\\{9319F59E-0909-4f39-B418-1CD6760555B2}.exe"	{CD476261-1E67-4517-BCC2-836B475AF573}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}	{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}\stubpath = "C:\\Windows\\{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}.exe"	{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}\stubpath = "C:\\Windows\\{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe"	436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CD476261-1E67-4517-BCC2-836B475AF573}	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F9828CC0-9B88-441b-B9A3-377147089A17}\stubpath = "C:\\Windows\\{F9828CC0-9B88-441b-B9A3-377147089A17}.exe"	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}\stubpath = "C:\\Windows\\{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe"	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50019ED7-4CE6-44d8-AA08-810A6E859532}\stubpath = "C:\\Windows\\{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe"	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}\stubpath = "C:\\Windows\\{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe"	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}\stubpath = "C:\\Windows\\{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe"	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50019ED7-4CE6-44d8-AA08-810A6E859532}	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe

Executes dropped EXE 12 IoCs

pid	Process
4160	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe
3020	{CD476261-1E67-4517-BCC2-836B475AF573}.exe
1100	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe
4092	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe
1848	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe
3012	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe
624	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe
1512	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe
1760	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe
1124	{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe
2676	{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}.exe
1772	{20F0EB55-9508-4c10-997D-BFF021E5DBC2}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{9319F59E-0909-4f39-B418-1CD6760555B2}.exe	{CD476261-1E67-4517-BCC2-836B475AF573}.exe
File created	C:\Windows\{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe
File created	C:\Windows\{F9828CC0-9B88-441b-B9A3-377147089A17}.exe	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe
File created	C:\Windows\{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe
File created	C:\Windows\{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}.exe	{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe
File created	C:\Windows\{20F0EB55-9508-4c10-997D-BFF021E5DBC2}.exe	{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}.exe
File created	C:\Windows\{CD476261-1E67-4517-BCC2-836B475AF573}.exe	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe
File created	C:\Windows\{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe
File created	C:\Windows\{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe
File created	C:\Windows\{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe
File created	C:\Windows\{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe
File created	C:\Windows\{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe	436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	672	436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe
Token: SeIncBasePriorityPrivilege	4160	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe
Token: SeIncBasePriorityPrivilege	3020	{CD476261-1E67-4517-BCC2-836B475AF573}.exe
Token: SeIncBasePriorityPrivilege	1100	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe
Token: SeIncBasePriorityPrivilege	4092	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe
Token: SeIncBasePriorityPrivilege	1848	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe
Token: SeIncBasePriorityPrivilege	3012	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe
Token: SeIncBasePriorityPrivilege	624	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe
Token: SeIncBasePriorityPrivilege	1512	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe
Token: SeIncBasePriorityPrivilege	1760	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe
Token: SeIncBasePriorityPrivilege	1124	{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe
Token: SeIncBasePriorityPrivilege	2676	{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 4160	672	436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe	94
PID 672 wrote to memory of 4160	672	436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe	94
PID 672 wrote to memory of 4160	672	436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe	94
PID 672 wrote to memory of 3864	672	436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe	95
PID 672 wrote to memory of 3864	672	436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe	95
PID 672 wrote to memory of 3864	672	436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe	95
PID 4160 wrote to memory of 3020	4160	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe	98
PID 4160 wrote to memory of 3020	4160	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe	98
PID 4160 wrote to memory of 3020	4160	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe	98
PID 4160 wrote to memory of 4608	4160	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe	99
PID 4160 wrote to memory of 4608	4160	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe	99
PID 4160 wrote to memory of 4608	4160	{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe	99
PID 3020 wrote to memory of 1100	3020	{CD476261-1E67-4517-BCC2-836B475AF573}.exe	102
PID 3020 wrote to memory of 1100	3020	{CD476261-1E67-4517-BCC2-836B475AF573}.exe	102
PID 3020 wrote to memory of 1100	3020	{CD476261-1E67-4517-BCC2-836B475AF573}.exe	102
PID 3020 wrote to memory of 2324	3020	{CD476261-1E67-4517-BCC2-836B475AF573}.exe	103
PID 3020 wrote to memory of 2324	3020	{CD476261-1E67-4517-BCC2-836B475AF573}.exe	103
PID 3020 wrote to memory of 2324	3020	{CD476261-1E67-4517-BCC2-836B475AF573}.exe	103
PID 1100 wrote to memory of 4092	1100	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe	104
PID 1100 wrote to memory of 4092	1100	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe	104
PID 1100 wrote to memory of 4092	1100	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe	104
PID 1100 wrote to memory of 4240	1100	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe	105
PID 1100 wrote to memory of 4240	1100	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe	105
PID 1100 wrote to memory of 4240	1100	{9319F59E-0909-4f39-B418-1CD6760555B2}.exe	105
PID 4092 wrote to memory of 1848	4092	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe	106
PID 4092 wrote to memory of 1848	4092	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe	106
PID 4092 wrote to memory of 1848	4092	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe	106
PID 4092 wrote to memory of 4576	4092	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe	107
PID 4092 wrote to memory of 4576	4092	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe	107
PID 4092 wrote to memory of 4576	4092	{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe	107
PID 1848 wrote to memory of 3012	1848	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe	108
PID 1848 wrote to memory of 3012	1848	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe	108
PID 1848 wrote to memory of 3012	1848	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe	108
PID 1848 wrote to memory of 3872	1848	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe	109
PID 1848 wrote to memory of 3872	1848	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe	109
PID 1848 wrote to memory of 3872	1848	{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe	109
PID 3012 wrote to memory of 624	3012	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe	110
PID 3012 wrote to memory of 624	3012	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe	110
PID 3012 wrote to memory of 624	3012	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe	110
PID 3012 wrote to memory of 396	3012	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe	111
PID 3012 wrote to memory of 396	3012	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe	111
PID 3012 wrote to memory of 396	3012	{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe	111
PID 624 wrote to memory of 1512	624	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe	112
PID 624 wrote to memory of 1512	624	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe	112
PID 624 wrote to memory of 1512	624	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe	112
PID 624 wrote to memory of 3576	624	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe	113
PID 624 wrote to memory of 3576	624	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe	113
PID 624 wrote to memory of 3576	624	{F9828CC0-9B88-441b-B9A3-377147089A17}.exe	113
PID 1512 wrote to memory of 1760	1512	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe	114
PID 1512 wrote to memory of 1760	1512	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe	114
PID 1512 wrote to memory of 1760	1512	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe	114
PID 1512 wrote to memory of 5008	1512	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe	115
PID 1512 wrote to memory of 5008	1512	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe	115
PID 1512 wrote to memory of 5008	1512	{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe	115
PID 1760 wrote to memory of 1124	1760	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe	116
PID 1760 wrote to memory of 1124	1760	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe	116
PID 1760 wrote to memory of 1124	1760	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe	116
PID 1760 wrote to memory of 3348	1760	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe	117
PID 1760 wrote to memory of 3348	1760	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe	117
PID 1760 wrote to memory of 3348	1760	{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe	117
PID 1124 wrote to memory of 2676	1124	{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe	118
PID 1124 wrote to memory of 2676	1124	{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe	118
PID 1124 wrote to memory of 2676	1124	{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe	118
PID 1124 wrote to memory of 4868	1124	{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe	119

C:\Users\Admin\AppData\Local\Temp\436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\436d7b39b107b403ae96859eb79a979ca283e1f0b92580613c9e388d31cbfc9c_NeikiAnalytics.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672
- C:\Windows\{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe
  C:\Windows\{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\{CD476261-1E67-4517-BCC2-836B475AF573}.exe
    C:\Windows\{CD476261-1E67-4517-BCC2-836B475AF573}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\{9319F59E-0909-4f39-B418-1CD6760555B2}.exe
      C:\Windows\{9319F59E-0909-4f39-B418-1CD6760555B2}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1100
    - - C:\Windows\{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe
        
        C:\Windows\{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4092
      - C:\Windows\{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe
        
        C:\Windows\{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe
        
        C:\Windows\{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\{F9828CC0-9B88-441b-B9A3-377147089A17}.exe
        
        C:\Windows\{F9828CC0-9B88-441b-B9A3-377147089A17}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe
        
        C:\Windows\{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1512
        
        C:\Windows\{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe
        
        C:\Windows\{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe
        10⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe
        
        C:\Windows\{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe
        11⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}.exe
        
        C:\Windows\{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}.exe
        12⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
        
        C:\Windows\{20F0EB55-9508-4c10-997D-BFF021E5DBC2}.exe
        
        C:\Windows\{20F0EB55-9508-4c10-997D-BFF021E5DBC2}.exe
        13⤵
        Executes dropped EXE
        
        PID:1772
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{52E4C~1.EXE > nul
        13⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{50019~1.EXE > nul
        12⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{1B57E~1.EXE > nul
        11⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2235B~1.EXE > nul
        10⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F9828~1.EXE > nul
        9⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D06F3~1.EXE > nul
        8⤵
        
        PID:396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6EA05~1.EXE > nul
        7⤵
        
        PID:3872
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0A115~1.EXE > nul
        6⤵
        
        PID:4576
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9319F~1.EXE > nul
        5⤵
        
        PID:4240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{CD476~1.EXE > nul
      4⤵
      PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{6E7EC~1.EXE > nul
    3⤵
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\436D7B~1.EXE > nul
  2⤵
  PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4152,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{0A1157CD-45D4-45e9-A540-383F7AAB6821}.exe

Filesize
90KB

MD5
edd4d6ad665b975dc3e2a1c12da8b834

SHA1
6ce63864a2675b17abb07e271b40ab569b4d7324

SHA256
24e639f7fdc79ae1d1c2374057b82d95b116da8421a8df365948ba5974d218b1

SHA512
a86137c5640155f2f1666793ebd8426f19a486e13e4be8b665becfe7909e0f14fc300f5c553548b038e7a80b6273508114c262e381c0a9453dacdcda5a62aa92

Download Submit
C:\Windows\{1B57E8DF-895C-48c2-8D12-FFEE8E79C68A}.exe

Filesize
90KB

MD5
2ece25f8b0e11dce0a966792132eda03

SHA1
a487b1996980653c38f735a24c9319f94eb1bb64

SHA256
eda03ade14dca3ef1dc3cdbdbb3d52ae725a0f1e7c5f308d1a2fa9811b753f3a

SHA512
56f83076b7c3b2fd52cd1d2a6acfc81f0524216ab82f8279401c6b6e3700cb6be94ba1d37826f5f60faf8734a44109828a59ac1b14e8607b01d40ad15a429ee1

Download Submit
C:\Windows\{20F0EB55-9508-4c10-997D-BFF021E5DBC2}.exe

Filesize
90KB

MD5
ea027797d8163cd6e6977d6284d09fa5

SHA1
e00ab301ad1ea7d341a7950f2b03986e311a75bb

SHA256
f509de7a91da1c8d3c5c14ab2c26ff68174050a64fc7e8cd5fc466e23c7f6dde

SHA512
1d2751fa3acfa03a98a0659e7aa956e5f157aad3f24ef6ab8d4cb64259a18f9362214b8ad8e9b6d74a46c28300d8c51b66da6545602fa32094522924f32497b8

Download Submit
C:\Windows\{2235B744-A71C-4c0b-9A65-C5B90B2E35C2}.exe

Filesize
90KB

MD5
40db8b0050485706ae672ac4892f9a7b

SHA1
b2a74b9f3272b91c5f670bd6b98fa78fd65059ee

SHA256
3656612aa94c4f5a58503c9fcd31935f55ae516fd79d8c7a46fd06719061417e

SHA512
f6a62601e0855143ba419eb5e03747bec66d6dc789029af40660ed61205726304e5ccbdf77ce54db4369288676d671f5b1b3069279f69a9ee86bafcc44413526

Download Submit
C:\Windows\{50019ED7-4CE6-44d8-AA08-810A6E859532}.exe

Filesize
90KB

MD5
e060bf22f8a3f5eafd8f5b58ea53bcce

SHA1
39b0efce5e602bb410c0df2cc707f0b35bfa41cc

SHA256
8f54c512fc968c8faf83487c795c9f86549a1da66bc25c6f77d244e748cacc46

SHA512
a75f9f68d7a0f240ceb18cc68b891d7b65e2f91344c8d3885301c4c4c057306072c1e26bfa1fa8c249d25086681c82ddc53fc904d9c271f8c2f57a618712062c

Download Submit
C:\Windows\{52E4CEB9-7A81-4d7f-9ACD-92E2F6FB0682}.exe

Filesize
90KB

MD5
026331f73fb739602abe45b45f4c6ad9

SHA1
3886b9ee76e2a48739c15ad67207e3d94a1413fa

SHA256
841dc5793618e488fda52bc91414754baa2ea9ccaf544293389ac8bfa2f37409

SHA512
155fccd0a17961a4e74072af028850eb4ccaa10461fece136962a57ed7a32d1472411411464b8f388b13f9b8a673df942433f094436b00701e59e809bf860b70

Download Submit
C:\Windows\{6E7ECBF5-9389-4e3a-A9A5-8A3AAAE21991}.exe

Filesize
90KB

MD5
9f91a3d388c4eb8e368bf8b99a2ef28f

SHA1
cd68b3468ca4977b95884348ddb1ff1faff1518a

SHA256
4c119f797c1ced7422ce180fde268be756454e47eca2c9df0d1cd98696890516

SHA512
b321d16024b13287c05b1d905a06b47de29bfd3eb991ce2f9c7b47a876cd983bc8c40f0735ad671b2e5c292f828334a6300b0abf10385d723738b1408f63353a

Download Submit
C:\Windows\{6EA05A81-4CD9-4930-AA8D-B1B6074D5537}.exe

Filesize
90KB

MD5
47bffe34c38bfa80c6676cefd7f38001

SHA1
9314dd2f5d5f0e52c027982ca9d080341393b8e7

SHA256
bd77615fcfa86bc0920258464b05868a49533042b312815f3e24d8d01a22d6e2

SHA512
aaef215d579ba7a27fe8479368e503dcaee6422d81da3e8dbaaacef12b7cd4fdaed544f4ce5bcc196d11cb39923eb2b31580cfd2cd7498a44c39cd7a4291f6f0

Download Submit
C:\Windows\{9319F59E-0909-4f39-B418-1CD6760555B2}.exe

Filesize
90KB

MD5
ea6b82b054c0f1c28d74237cfb513dfb

SHA1
ee277007c5983434cde30f2b99b39496bfe37a60

SHA256
bac248e3b7511754f26daa48f343fa91bb27e4de15fe4c5e040ff3df6f033456

SHA512
852dcbe4f411d2e02e350819e9f59d47897b18226beca8b35062672135f120f6fd65024a5097516a2dc05389efbfcfba892ae2576bd542c964d7e968d5a29808

Download Submit
C:\Windows\{CD476261-1E67-4517-BCC2-836B475AF573}.exe

Filesize
90KB

MD5
8db2d8c7d703cb5967f8c6001129b269

SHA1
4591abf63528c9e936f314f00aa17893afe93f7b

SHA256
64dc87f41b3e21d3b70c7a952475e27ed48714cc0cfeb639fe421dbd32338ba0

SHA512
a580c38264080d5402f28c60950a2184942db69c122ae76fdd97d416c786efc7c69423554acdee2306cb6b8c7af680b448b8714c1ee9124fc3b8e4800fb256f7

Download Submit
C:\Windows\{D06F3CF1-F14A-4430-9E51-FBAEE5992A89}.exe

Filesize
90KB

MD5
2eb9b3238f167b3c5b4902284fa13941

SHA1
315819337d3428fe4bb15ec93d12a8707ff639ba

SHA256
4ceeabdd355785d4dbc990ddf92725c9e79bb3eb1fb54eafb0faac39b0cafb6d

SHA512
80338fff18aa1c9ad91779414ab36fca1b69fed32b1271155cb905edebe169d2e8fbef583672092f99358e33b778cffbda6c6a8b37b054487864ba1d61bda3f5

Download Submit
C:\Windows\{F9828CC0-9B88-441b-B9A3-377147089A17}.exe

Filesize
90KB

MD5
6a9ca74f0a4395ad4e9212a3b4e78e21

SHA1
4d642029d20009147bec8f4632180ba228ebf943

SHA256
c2b59d111b79b7b731a4cb169137042d07dc9d29896e9e4009f33e6465afc885

SHA512
d691d3c4fa18b3cb146953253a5bb2f7ca0091f85a9b5ed8abb2e1cf28e68977d6b7c8bd2b07d413e5e401e58f4781e7573dee9a580e8959d6269ae7e368855f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads