Analysis
-
max time kernel
115s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 22:00
Static task
static1
Behavioral task
behavioral1
Sample
03dfa7d5332d63c018391db2760d43b652db545e27443de90b63bb44cf7d3239_NeikiAnalytics.dll
Resource
win7-20240611-en
General
-
Target
03dfa7d5332d63c018391db2760d43b652db545e27443de90b63bb44cf7d3239_NeikiAnalytics.dll
-
Size
120KB
-
MD5
8869c3123e84d249b133e4f48727d380
-
SHA1
187294fc1a829cb46ab7d9858e3891c4873f682b
-
SHA256
03dfa7d5332d63c018391db2760d43b652db545e27443de90b63bb44cf7d3239
-
SHA512
a30a753a23a942b51afa0c3a45cc3d89cffd9c13c4ff10606082456e8339f512e4aea9f326bb0d07b25d5c23740e2baa443a772e11f6b08485daa66cbe1f07d5
-
SSDEEP
3072:DmQimvGDY+yKY6aZ0KxZalyiHPHk6ix4GwGl3D:SYGs+dY6adalyivHvIZ3
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
e5843ca.exee584282.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e584282.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e584282.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e5843ca.exe -
Processes:
e584282.exee5843ca.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5843ca.exe -
Processes:
e5843ca.exee584282.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5843ca.exe -
Executes dropped EXE 3 IoCs
Processes:
e584282.exee5843ca.exee587412.exepid process 1420 e584282.exe 4076 e5843ca.exe 4128 e587412.exe -
Processes:
resource yara_rule behavioral2/memory/1420-6-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-10-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-9-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-8-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-12-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-13-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-26-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-32-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-25-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-29-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-37-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-36-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-38-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-42-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-39-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-54-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-55-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-56-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-57-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-60-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-61-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/1420-63-0x0000000000770000-0x000000000182A000-memory.dmp upx behavioral2/memory/4076-90-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4076-87-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4076-86-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4076-85-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4076-89-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4076-88-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4076-83-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx behavioral2/memory/4076-104-0x0000000000B40000-0x0000000001BFA000-memory.dmp upx -
Processes:
e584282.exee5843ca.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e5843ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e5843ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e5843ca.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e5843ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e584282.exe -
Processes:
e584282.exee5843ca.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5843ca.exe -
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e584282.exedescription ioc process File opened (read-only) \??\J: e584282.exe File opened (read-only) \??\K: e584282.exe File opened (read-only) \??\E: e584282.exe File opened (read-only) \??\G: e584282.exe File opened (read-only) \??\H: e584282.exe File opened (read-only) \??\I: e584282.exe -
Drops file in Windows directory 3 IoCs
Processes:
e5843ca.exee584282.exedescription ioc process File created C:\Windows\e589361 e5843ca.exe File created C:\Windows\e5842d0 e584282.exe File opened for modification C:\Windows\SYSTEM.INI e584282.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e584282.exepid process 1420 e584282.exe 1420 e584282.exe 1420 e584282.exe 1420 e584282.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e584282.exedescription pid process Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe Token: SeDebugPrivilege 1420 e584282.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee584282.exedescription pid process target process PID 4984 wrote to memory of 1388 4984 rundll32.exe rundll32.exe PID 4984 wrote to memory of 1388 4984 rundll32.exe rundll32.exe PID 4984 wrote to memory of 1388 4984 rundll32.exe rundll32.exe PID 1388 wrote to memory of 1420 1388 rundll32.exe e584282.exe PID 1388 wrote to memory of 1420 1388 rundll32.exe e584282.exe PID 1388 wrote to memory of 1420 1388 rundll32.exe e584282.exe PID 1420 wrote to memory of 764 1420 e584282.exe fontdrvhost.exe PID 1420 wrote to memory of 768 1420 e584282.exe fontdrvhost.exe PID 1420 wrote to memory of 64 1420 e584282.exe dwm.exe PID 1420 wrote to memory of 2860 1420 e584282.exe sihost.exe PID 1420 wrote to memory of 2924 1420 e584282.exe svchost.exe PID 1420 wrote to memory of 3048 1420 e584282.exe taskhostw.exe PID 1420 wrote to memory of 3444 1420 e584282.exe Explorer.EXE PID 1420 wrote to memory of 3616 1420 e584282.exe svchost.exe PID 1420 wrote to memory of 3812 1420 e584282.exe DllHost.exe PID 1420 wrote to memory of 3992 1420 e584282.exe StartMenuExperienceHost.exe PID 1420 wrote to memory of 4056 1420 e584282.exe RuntimeBroker.exe PID 1420 wrote to memory of 3728 1420 e584282.exe SearchApp.exe PID 1420 wrote to memory of 4120 1420 e584282.exe RuntimeBroker.exe PID 1420 wrote to memory of 2272 1420 e584282.exe TextInputHost.exe PID 1420 wrote to memory of 2120 1420 e584282.exe RuntimeBroker.exe PID 1420 wrote to memory of 2680 1420 e584282.exe msedge.exe PID 1420 wrote to memory of 4328 1420 e584282.exe msedge.exe PID 1420 wrote to memory of 4160 1420 e584282.exe msedge.exe PID 1420 wrote to memory of 3888 1420 e584282.exe msedge.exe PID 1420 wrote to memory of 1680 1420 e584282.exe msedge.exe PID 1420 wrote to memory of 4992 1420 e584282.exe RuntimeBroker.exe PID 1420 wrote to memory of 636 1420 e584282.exe backgroundTaskHost.exe PID 1420 wrote to memory of 3656 1420 e584282.exe backgroundTaskHost.exe PID 1420 wrote to memory of 4984 1420 e584282.exe rundll32.exe PID 1420 wrote to memory of 1388 1420 e584282.exe rundll32.exe PID 1420 wrote to memory of 1388 1420 e584282.exe rundll32.exe PID 1388 wrote to memory of 4076 1388 rundll32.exe e5843ca.exe PID 1388 wrote to memory of 4076 1388 rundll32.exe e5843ca.exe PID 1388 wrote to memory of 4076 1388 rundll32.exe e5843ca.exe PID 1420 wrote to memory of 764 1420 e584282.exe fontdrvhost.exe PID 1420 wrote to memory of 768 1420 e584282.exe fontdrvhost.exe PID 1420 wrote to memory of 64 1420 e584282.exe dwm.exe PID 1420 wrote to memory of 2860 1420 e584282.exe sihost.exe PID 1420 wrote to memory of 2924 1420 e584282.exe svchost.exe PID 1420 wrote to memory of 3048 1420 e584282.exe taskhostw.exe PID 1420 wrote to memory of 3444 1420 e584282.exe Explorer.EXE PID 1420 wrote to memory of 3616 1420 e584282.exe svchost.exe PID 1420 wrote to memory of 3812 1420 e584282.exe DllHost.exe PID 1420 wrote to memory of 3992 1420 e584282.exe StartMenuExperienceHost.exe PID 1420 wrote to memory of 4056 1420 e584282.exe RuntimeBroker.exe PID 1420 wrote to memory of 3728 1420 e584282.exe SearchApp.exe PID 1420 wrote to memory of 4120 1420 e584282.exe RuntimeBroker.exe PID 1420 wrote to memory of 2272 1420 e584282.exe TextInputHost.exe PID 1420 wrote to memory of 2120 1420 e584282.exe RuntimeBroker.exe PID 1420 wrote to memory of 2680 1420 e584282.exe msedge.exe PID 1420 wrote to memory of 4328 1420 e584282.exe msedge.exe PID 1420 wrote to memory of 4160 1420 e584282.exe msedge.exe PID 1420 wrote to memory of 3888 1420 e584282.exe msedge.exe PID 1420 wrote to memory of 1680 1420 e584282.exe msedge.exe PID 1420 wrote to memory of 4992 1420 e584282.exe RuntimeBroker.exe PID 1420 wrote to memory of 636 1420 e584282.exe backgroundTaskHost.exe PID 1420 wrote to memory of 3656 1420 e584282.exe backgroundTaskHost.exe PID 1420 wrote to memory of 4984 1420 e584282.exe rundll32.exe PID 1420 wrote to memory of 4076 1420 e584282.exe e5843ca.exe PID 1420 wrote to memory of 4076 1420 e584282.exe e5843ca.exe PID 1420 wrote to memory of 4420 1420 e584282.exe BackgroundTaskHost.exe PID 1388 wrote to memory of 4128 1388 rundll32.exe e587412.exe PID 1388 wrote to memory of 4128 1388 rundll32.exe e587412.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e584282.exee5843ca.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e584282.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e5843ca.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\03dfa7d5332d63c018391db2760d43b652db545e27443de90b63bb44cf7d3239_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\03dfa7d5332d63c018391db2760d43b652db545e27443de90b63bb44cf7d3239_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e584282.exeC:\Users\Admin\AppData\Local\Temp\e584282.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e5843ca.exeC:\Users\Admin\AppData\Local\Temp\e5843ca.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e587412.exeC:\Users\Admin\AppData\Local\Temp\e587412.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=125.0.6422.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=125.0.2535.92 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7fffdb4a4ef8,0x7fffdb4a4f04,0x7fffdb4a4f102⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2320,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1968,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2432,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4596,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:82⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e584282.exeFilesize
97KB
MD513d743fff676e5875cbb8fd864f13b2a
SHA1eda3d652b12d08a94e71c3544db7f4bdf893dee0
SHA25660b28b95453c976b7c8321d90c300757d6268355e4a1dc17d2800e84c7f24085
SHA5125fafd089f368d31e96489b8380c93af4c31afbbec6c6990dad543b6b7f8996985ea2043af2989c1f61d07792856de1e879ce33bb66d32f36a488329f00833c80
-
C:\Windows\SYSTEM.INIFilesize
256B
MD59cc9a040ca10e56355fb333afa9be051
SHA140b0998138c4dcef0a032235950b4b3a6a0cae79
SHA2568a900a566d559dd8a5329086d32b15eb3686d7fb33e8b840b672a6655ee63463
SHA5128b3e9dc9b100409542111ec25977e9155a6eca71bf9d76f7221f84108e1a1dfc8dd342fbe7d96c06004c725ecfd4f5b1baaaa9cfa1f9ecbefe0c1de38f3a7c4b
-
memory/1388-35-0x0000000004390000-0x0000000004392000-memory.dmpFilesize
8KB
-
memory/1388-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/1388-15-0x00000000043E0000-0x00000000043E1000-memory.dmpFilesize
4KB
-
memory/1388-18-0x0000000004390000-0x0000000004392000-memory.dmpFilesize
8KB
-
memory/1388-14-0x0000000004390000-0x0000000004392000-memory.dmpFilesize
8KB
-
memory/1420-63-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-39-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-13-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-26-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-8-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1420-33-0x0000000001B00000-0x0000000001B02000-memory.dmpFilesize
8KB
-
memory/1420-32-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-25-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-9-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-17-0x0000000001B10000-0x0000000001B11000-memory.dmpFilesize
4KB
-
memory/1420-10-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-27-0x0000000001B00000-0x0000000001B02000-memory.dmpFilesize
8KB
-
memory/1420-29-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-37-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-36-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-38-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1420-71-0x0000000001B00000-0x0000000001B02000-memory.dmpFilesize
8KB
-
memory/1420-6-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-42-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-12-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-61-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-54-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-55-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-56-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-57-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/1420-60-0x0000000000770000-0x000000000182A000-memory.dmpFilesize
16.7MB
-
memory/4076-86-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/4076-89-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/4076-41-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4076-44-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4076-105-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4076-100-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4076-43-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4076-90-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/4076-34-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4076-85-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/4076-87-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/4076-88-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/4076-83-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/4076-104-0x0000000000B40000-0x0000000001BFA000-memory.dmpFilesize
16.7MB
-
memory/4128-53-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4128-106-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB