sality | 2aa46aa75850008b43d1f85cf6de317d4c02fd6fc5923898fc2be35bf1e3e76d

Analysis

max time kernel
51s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 22:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2aa46aa75850008b43d1f85cf6de317d4c02fd6fc5923898fc2be35bf1e3e76d_NeikiAnalytics.dll
Size

120KB
MD5

943a35338aef0ac7a6711ed208231ae0
SHA1

c5653d29a00717a150d3d06c56aa7eeffadc53be
SHA256

2aa46aa75850008b43d1f85cf6de317d4c02fd6fc5923898fc2be35bf1e3e76d
SHA512

39c941ef89bef53a874f6049ec57632ebde58898c7b0b1d6506356a36d46c69e1c2254a8abb5546f4a14a071beb31e9d19f5ea77757d499fdf50099277d24f09
SSDEEP

1536:judG1BlsLHd1RoGUZ46rL9FvY3r8AqIWSd4Zw/WPyMxA10BN/r768z9fRqoIGxyw:6dYl0D7UmwHw78tIH6Aw28z94bY

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e574cf7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e574cf7.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

e574cf7.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574cf7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574cf7.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574cf7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e574cf7.exe

Executes dropped EXE 3 IoCs

Processes:

e574cf7.exee574e7e.exee5768cc.exe

pid process

3932 e574cf7.exe
2596 e574e7e.exe
1828 e5768cc.exe

pid	process
3932	e574cf7.exe
2596	e574e7e.exe
1828	e5768cc.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3932-6-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-10-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-17-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-18-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-27-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-31-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-25-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-11-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-19-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-9-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-37-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-36-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-38-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-39-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-40-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-42-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-43-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-52-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-54-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-55-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-66-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-67-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-70-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-72-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-74-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-76-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-83-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-85-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-87-0x0000000000810000-0x00000000018CA000-memory.dmp	upx
behavioral2/memory/3932-91-0x0000000000810000-0x00000000018CA000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574cf7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e574cf7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e574cf7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e574cf7.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

e574cf7.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574cf7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574cf7.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e574cf7.exe

description	ioc	process
File opened (read-only)	\??\R:	e574cf7.exe
File opened (read-only)	\??\S:	e574cf7.exe
File opened (read-only)	\??\E:	e574cf7.exe
File opened (read-only)	\??\M:	e574cf7.exe
File opened (read-only)	\??\N:	e574cf7.exe
File opened (read-only)	\??\O:	e574cf7.exe
File opened (read-only)	\??\Q:	e574cf7.exe
File opened (read-only)	\??\K:	e574cf7.exe
File opened (read-only)	\??\G:	e574cf7.exe
File opened (read-only)	\??\L:	e574cf7.exe
File opened (read-only)	\??\H:	e574cf7.exe
File opened (read-only)	\??\I:	e574cf7.exe
File opened (read-only)	\??\J:	e574cf7.exe
File opened (read-only)	\??\P:	e574cf7.exe

Drops file in Program Files directory 4 IoCs

Processes:

e574cf7.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e574cf7.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e574cf7.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e574cf7.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e574cf7.exe

Drops file in Windows directory 2 IoCs

Processes:

e574cf7.exe

description ioc process

File created C:\Windows\e574d45 e574cf7.exe
File opened for modification C:\Windows\SYSTEM.INI e574cf7.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e574cf7.exe

pid process

3932 e574cf7.exe
3932 e574cf7.exe
3932 e574cf7.exe
3932 e574cf7.exe

description	ioc	process
File created	C:\Windows\e574d45	e574cf7.exe
File opened for modification	C:\Windows\SYSTEM.INI	e574cf7.exe

pid	process
3932	e574cf7.exe
3932	e574cf7.exe
3932	e574cf7.exe
3932	e574cf7.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e574cf7.exe

description	pid	process
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe
Token: SeDebugPrivilege	3932	e574cf7.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

rundll32.exerundll32.exee574cf7.exe

description	pid	process	target process
PID 1936 wrote to memory of 432	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 432	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 432	1936	rundll32.exe	rundll32.exe
PID 432 wrote to memory of 3932	432	rundll32.exe	e574cf7.exe
PID 432 wrote to memory of 3932	432	rundll32.exe	e574cf7.exe
PID 432 wrote to memory of 3932	432	rundll32.exe	e574cf7.exe
PID 3932 wrote to memory of 804	3932	e574cf7.exe	fontdrvhost.exe
PID 3932 wrote to memory of 812	3932	e574cf7.exe	fontdrvhost.exe
PID 3932 wrote to memory of 336	3932	e574cf7.exe	dwm.exe
PID 3932 wrote to memory of 2604	3932	e574cf7.exe	sihost.exe
PID 3932 wrote to memory of 2652	3932	e574cf7.exe	svchost.exe
PID 3932 wrote to memory of 2992	3932	e574cf7.exe	taskhostw.exe
PID 3932 wrote to memory of 3444	3932	e574cf7.exe	Explorer.EXE
PID 3932 wrote to memory of 3556	3932	e574cf7.exe	svchost.exe
PID 3932 wrote to memory of 3740	3932	e574cf7.exe	DllHost.exe
PID 3932 wrote to memory of 3832	3932	e574cf7.exe	StartMenuExperienceHost.exe
PID 3932 wrote to memory of 3896	3932	e574cf7.exe	RuntimeBroker.exe
PID 3932 wrote to memory of 3992	3932	e574cf7.exe	SearchApp.exe
PID 3932 wrote to memory of 3588	3932	e574cf7.exe	RuntimeBroker.exe
PID 3932 wrote to memory of 4404	3932	e574cf7.exe	RuntimeBroker.exe
PID 3932 wrote to memory of 928	3932	e574cf7.exe	TextInputHost.exe
PID 3932 wrote to memory of 1936	3932	e574cf7.exe	rundll32.exe
PID 3932 wrote to memory of 432	3932	e574cf7.exe	rundll32.exe
PID 3932 wrote to memory of 432	3932	e574cf7.exe	rundll32.exe
PID 432 wrote to memory of 2596	432	rundll32.exe	e574e7e.exe
PID 432 wrote to memory of 2596	432	rundll32.exe	e574e7e.exe
PID 432 wrote to memory of 2596	432	rundll32.exe	e574e7e.exe
PID 432 wrote to memory of 1828	432	rundll32.exe	e5768cc.exe
PID 432 wrote to memory of 1828	432	rundll32.exe	e5768cc.exe
PID 432 wrote to memory of 1828	432	rundll32.exe	e5768cc.exe
PID 3932 wrote to memory of 804	3932	e574cf7.exe	fontdrvhost.exe
PID 3932 wrote to memory of 812	3932	e574cf7.exe	fontdrvhost.exe
PID 3932 wrote to memory of 336	3932	e574cf7.exe	dwm.exe
PID 3932 wrote to memory of 2604	3932	e574cf7.exe	sihost.exe
PID 3932 wrote to memory of 2652	3932	e574cf7.exe	svchost.exe
PID 3932 wrote to memory of 2992	3932	e574cf7.exe	taskhostw.exe
PID 3932 wrote to memory of 3444	3932	e574cf7.exe	Explorer.EXE
PID 3932 wrote to memory of 3556	3932	e574cf7.exe	svchost.exe
PID 3932 wrote to memory of 3740	3932	e574cf7.exe	DllHost.exe
PID 3932 wrote to memory of 3832	3932	e574cf7.exe	StartMenuExperienceHost.exe
PID 3932 wrote to memory of 3896	3932	e574cf7.exe	RuntimeBroker.exe
PID 3932 wrote to memory of 3992	3932	e574cf7.exe	SearchApp.exe
PID 3932 wrote to memory of 3588	3932	e574cf7.exe	RuntimeBroker.exe
PID 3932 wrote to memory of 4404	3932	e574cf7.exe	RuntimeBroker.exe
PID 3932 wrote to memory of 928	3932	e574cf7.exe	TextInputHost.exe
PID 3932 wrote to memory of 2596	3932	e574cf7.exe	e574e7e.exe
PID 3932 wrote to memory of 2596	3932	e574cf7.exe	e574e7e.exe
PID 3932 wrote to memory of 1828	3932	e574cf7.exe	e5768cc.exe
PID 3932 wrote to memory of 1828	3932	e574cf7.exe	e5768cc.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

e574cf7.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574cf7.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574cf7.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:804

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:812

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:336

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2652

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2992

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aa46aa75850008b43d1f85cf6de317d4c02fd6fc5923898fc2be35bf1e3e76d_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2aa46aa75850008b43d1f85cf6de317d4c02fd6fc5923898fc2be35bf1e3e76d_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:432

C:\Users\Admin\AppData\Local\Temp\e574cf7.exe
C:\Users\Admin\AppData\Local\Temp\e574cf7.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3932

C:\Users\Admin\AppData\Local\Temp\e574e7e.exe
C:\Users\Admin\AppData\Local\Temp\e574e7e.exe
4⤵
- Executes dropped EXE
PID:2596

C:\Users\Admin\AppData\Local\Temp\e5768cc.exe
C:\Users\Admin\AppData\Local\Temp\e5768cc.exe
4⤵
- Executes dropped EXE
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3556

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3740

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3832

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3992

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3588

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4404

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:928

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e574cf7.exe
Filesize
97KB

MD5
121051f0ad19c6d228f7c6878fa0459a

SHA1
7acb9d0626a5065822b437dde7b82052feb62f9a

SHA256
d0ea07cdc6f0512ee21808ccaf1c3d10babf7169337079b3f0cb804a81eb6472

SHA512
3d5a5220e90254944401d2ed8aa160f283c5e3ad526799eb08c80dcd99d85e6b22d32eb9a1bc178c1f33da6d7c4cab28422092ec27ce9472b4dbeae33f868182

Download Submit
memory/432-28-0x0000000001140000-0x0000000001142000-memory.dmp

Filesize
8KB

Download
memory/432-20-0x0000000001140000-0x0000000001142000-memory.dmp

Filesize
8KB

Download
memory/432-3-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/432-21-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/432-49-0x0000000001140000-0x0000000001142000-memory.dmp

Filesize
8KB

Download
memory/432-24-0x0000000001140000-0x0000000001142000-memory.dmp

Filesize
8KB

Download
memory/1828-48-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1828-62-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1828-64-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1828-61-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1828-115-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2596-63-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2596-35-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2596-59-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2596-58-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/2596-111-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3932-42-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-27-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-19-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-9-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-37-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-36-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-38-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-39-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-40-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-29-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/3932-43-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-23-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/3932-25-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-52-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-54-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-55-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-31-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-11-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-30-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/3932-18-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-17-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-10-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-66-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-67-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-70-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-72-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-74-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-76-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-83-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-85-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-87-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-96-0x00000000005F0000-0x00000000005F2000-memory.dmp

Filesize
8KB

Download
memory/3932-107-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3932-6-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-91-0x0000000000810000-0x00000000018CA000-memory.dmp

Filesize
16.7MB

Download
memory/3932-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads