sality | 049d6dd08066d6211bcd8e00da13b1ca0da714c7b87be0f57c7063a9c8fd8a07

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

049d6dd08066d6211bcd8e00da13b1ca0da714c7b87be0f57c7063a9c8fd8a07_NeikiAnalytics.dll
Size

120KB
MD5

97ada4209c9c8a97d5a542cdecf2b030
SHA1

f1770c8bfe50c519c02a1965dcf35fe95ad15e03
SHA256

049d6dd08066d6211bcd8e00da13b1ca0da714c7b87be0f57c7063a9c8fd8a07
SHA512

e87fd74a070b25bcdd1f94a7b0b52680b5639bc73d2c7f3a9fb41a5e2bd6f46072fc600139979091d352fa35648d7e37f895b830207d13b6dba887c363b5b84e
SSDEEP

3072:hW+qFgLzqd+DwhylXSDzlg9Pk1Y4iuoycm:hWLgLi+DwrHlg9s1YnOt

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e57f2dc.exee580ed0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e580ed0.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e57f2dc.exee580ed0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e580ed0.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e57f2dc.exee580ed0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e580ed0.exe

Executes dropped EXE 4 IoCs

Processes:

e57f2dc.exee57f3c6.exee580ec0.exee580ed0.exe

pid process

2208 e57f2dc.exe
2956 e57f3c6.exe
4876 e580ec0.exe
2196 e580ed0.exe

pid	process
2208	e57f2dc.exe
2956	e57f3c6.exe
4876	e580ec0.exe
2196	e580ed0.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2208-9-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-10-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-20-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-31-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-19-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-33-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-34-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-22-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-11-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-8-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-35-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-36-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-37-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-38-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-39-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-41-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-42-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-56-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-58-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-59-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-73-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-75-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-78-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-80-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-83-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-84-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-86-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-87-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-88-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-90-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2208-94-0x0000000000800000-0x00000000018BA000-memory.dmp	upx
behavioral2/memory/2196-141-0x0000000000B50000-0x0000000001C0A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e57f2dc.exee580ed0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e57f2dc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e580ed0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e580ed0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e580ed0.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e57f2dc.exee580ed0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e580ed0.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e57f2dc.exe

description	ioc	process
File opened (read-only)	\??\L:	e57f2dc.exe
File opened (read-only)	\??\M:	e57f2dc.exe
File opened (read-only)	\??\N:	e57f2dc.exe
File opened (read-only)	\??\P:	e57f2dc.exe
File opened (read-only)	\??\K:	e57f2dc.exe
File opened (read-only)	\??\O:	e57f2dc.exe
File opened (read-only)	\??\E:	e57f2dc.exe
File opened (read-only)	\??\H:	e57f2dc.exe
File opened (read-only)	\??\I:	e57f2dc.exe
File opened (read-only)	\??\Q:	e57f2dc.exe
File opened (read-only)	\??\S:	e57f2dc.exe
File opened (read-only)	\??\G:	e57f2dc.exe
File opened (read-only)	\??\J:	e57f2dc.exe
File opened (read-only)	\??\R:	e57f2dc.exe

Drops file in Program Files directory 4 IoCs

Processes:

e57f2dc.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e57f2dc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e57f2dc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e57f2dc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	e57f2dc.exe

Drops file in Windows directory 3 IoCs

Processes:

e57f2dc.exee580ed0.exe

description ioc process

File created C:\Windows\e57f32a e57f2dc.exe
File opened for modification C:\Windows\SYSTEM.INI e57f2dc.exe
File created C:\Windows\e585d4e e580ed0.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e57f2dc.exe

pid process

2208 e57f2dc.exe
2208 e57f2dc.exe
2208 e57f2dc.exe
2208 e57f2dc.exe

description	ioc	process
File created	C:\Windows\e57f32a	e57f2dc.exe
File opened for modification	C:\Windows\SYSTEM.INI	e57f2dc.exe
File created	C:\Windows\e585d4e	e580ed0.exe

pid	process
2208	e57f2dc.exe
2208	e57f2dc.exe
2208	e57f2dc.exe
2208	e57f2dc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e57f2dc.exe

description	pid	process
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe
Token: SeDebugPrivilege	2208	e57f2dc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exee57f2dc.exe

description	pid	process	target process
PID 4664 wrote to memory of 1380	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 1380	4664	rundll32.exe	rundll32.exe
PID 4664 wrote to memory of 1380	4664	rundll32.exe	rundll32.exe
PID 1380 wrote to memory of 2208	1380	rundll32.exe	e57f2dc.exe
PID 1380 wrote to memory of 2208	1380	rundll32.exe	e57f2dc.exe
PID 1380 wrote to memory of 2208	1380	rundll32.exe	e57f2dc.exe
PID 2208 wrote to memory of 784	2208	e57f2dc.exe	fontdrvhost.exe
PID 2208 wrote to memory of 788	2208	e57f2dc.exe	fontdrvhost.exe
PID 2208 wrote to memory of 320	2208	e57f2dc.exe	dwm.exe
PID 2208 wrote to memory of 2548	2208	e57f2dc.exe	sihost.exe
PID 2208 wrote to memory of 2568	2208	e57f2dc.exe	svchost.exe
PID 2208 wrote to memory of 2672	2208	e57f2dc.exe	taskhostw.exe
PID 2208 wrote to memory of 3460	2208	e57f2dc.exe	Explorer.EXE
PID 2208 wrote to memory of 3596	2208	e57f2dc.exe	svchost.exe
PID 2208 wrote to memory of 3760	2208	e57f2dc.exe	DllHost.exe
PID 2208 wrote to memory of 3852	2208	e57f2dc.exe	StartMenuExperienceHost.exe
PID 2208 wrote to memory of 3912	2208	e57f2dc.exe	RuntimeBroker.exe
PID 2208 wrote to memory of 4040	2208	e57f2dc.exe	SearchApp.exe
PID 2208 wrote to memory of 2376	2208	e57f2dc.exe	RuntimeBroker.exe
PID 2208 wrote to memory of 2300	2208	e57f2dc.exe	RuntimeBroker.exe
PID 2208 wrote to memory of 3820	2208	e57f2dc.exe	TextInputHost.exe
PID 2208 wrote to memory of 2696	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 1648	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 2540	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 648	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 544	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 4664	2208	e57f2dc.exe	rundll32.exe
PID 2208 wrote to memory of 1380	2208	e57f2dc.exe	rundll32.exe
PID 2208 wrote to memory of 1380	2208	e57f2dc.exe	rundll32.exe
PID 1380 wrote to memory of 2956	1380	rundll32.exe	e57f3c6.exe
PID 1380 wrote to memory of 2956	1380	rundll32.exe	e57f3c6.exe
PID 1380 wrote to memory of 2956	1380	rundll32.exe	e57f3c6.exe
PID 1380 wrote to memory of 4876	1380	rundll32.exe	e580ec0.exe
PID 1380 wrote to memory of 4876	1380	rundll32.exe	e580ec0.exe
PID 1380 wrote to memory of 4876	1380	rundll32.exe	e580ec0.exe
PID 1380 wrote to memory of 2196	1380	rundll32.exe	e580ed0.exe
PID 1380 wrote to memory of 2196	1380	rundll32.exe	e580ed0.exe
PID 1380 wrote to memory of 2196	1380	rundll32.exe	e580ed0.exe
PID 2208 wrote to memory of 784	2208	e57f2dc.exe	fontdrvhost.exe
PID 2208 wrote to memory of 788	2208	e57f2dc.exe	fontdrvhost.exe
PID 2208 wrote to memory of 320	2208	e57f2dc.exe	dwm.exe
PID 2208 wrote to memory of 2548	2208	e57f2dc.exe	sihost.exe
PID 2208 wrote to memory of 2568	2208	e57f2dc.exe	svchost.exe
PID 2208 wrote to memory of 2672	2208	e57f2dc.exe	taskhostw.exe
PID 2208 wrote to memory of 3460	2208	e57f2dc.exe	Explorer.EXE
PID 2208 wrote to memory of 3596	2208	e57f2dc.exe	svchost.exe
PID 2208 wrote to memory of 3760	2208	e57f2dc.exe	DllHost.exe
PID 2208 wrote to memory of 3852	2208	e57f2dc.exe	StartMenuExperienceHost.exe
PID 2208 wrote to memory of 3912	2208	e57f2dc.exe	RuntimeBroker.exe
PID 2208 wrote to memory of 4040	2208	e57f2dc.exe	SearchApp.exe
PID 2208 wrote to memory of 2376	2208	e57f2dc.exe	RuntimeBroker.exe
PID 2208 wrote to memory of 2300	2208	e57f2dc.exe	RuntimeBroker.exe
PID 2208 wrote to memory of 3820	2208	e57f2dc.exe	TextInputHost.exe
PID 2208 wrote to memory of 2696	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 1648	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 2540	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 648	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 544	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 2956	2208	e57f2dc.exe	e57f3c6.exe
PID 2208 wrote to memory of 2956	2208	e57f2dc.exe	e57f3c6.exe
PID 2208 wrote to memory of 1700	2208	e57f2dc.exe	msedge.exe
PID 2208 wrote to memory of 4876	2208	e57f2dc.exe	e580ec0.exe
PID 2208 wrote to memory of 4876	2208	e57f2dc.exe	e580ec0.exe
PID 2208 wrote to memory of 2196	2208	e57f2dc.exe	e580ed0.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e57f2dc.exee580ed0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e57f2dc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e580ed0.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:320

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2568

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2672

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3460

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\049d6dd08066d6211bcd8e00da13b1ca0da714c7b87be0f57c7063a9c8fd8a07_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\049d6dd08066d6211bcd8e00da13b1ca0da714c7b87be0f57c7063a9c8fd8a07_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Users\Admin\AppData\Local\Temp\e57f2dc.exe
C:\Users\Admin\AppData\Local\Temp\e57f2dc.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2208

C:\Users\Admin\AppData\Local\Temp\e57f3c6.exe
C:\Users\Admin\AppData\Local\Temp\e57f3c6.exe
4⤵
- Executes dropped EXE
PID:2956

C:\Users\Admin\AppData\Local\Temp\e580ec0.exe
C:\Users\Admin\AppData\Local\Temp\e580ec0.exe
4⤵
- Executes dropped EXE
PID:4876

C:\Users\Admin\AppData\Local\Temp\e580ed0.exe
C:\Users\Admin\AppData\Local\Temp\e580ed0.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3596

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3760

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3912

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4040

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2300

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7fff0ec5ceb8,0x7fff0ec5cec4,0x7fff0ec5ced0
2⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2284,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
2⤵
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1940,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:3
2⤵
PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:8
2⤵
PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4272,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
2⤵
PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e57f2dc.exe
Filesize
97KB

MD5
698141a3012e5f0ff590938d6678b443

SHA1
bff98b84f0e2916e6362012ec80a86ed7df09892

SHA256
cc49f1b74348ef5b3c19ea161da5980ddb971f1eaeb8007b6d6691f4491d6edf

SHA512
0dbf48c941b2563fa198846cf6300c63739b10bbcf8fbce42163e0c6f013bfc06eb258ee5ca69105675ff80c277b4ab7e45a1eeaf09105016e19c7c744225be4

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
948ee6f6b2a78165840811b0b50a9b60

SHA1
3bae4cd7b3457b14d139f77ee0dee8655837a6c6

SHA256
e10f8f338ce688f4c26274a32be3d15e06158b44b59869a7d12558917694ab1c

SHA512
73ef2fd4cfd9049e90a0b7ff68bb064bf14cf6e0b5cb827d5819ef67b604caff9aa43ae9f30176d740b317493fb7613abdd3f96a100294c089d86b77bc2b1af5

Download Submit
memory/1380-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/1380-23-0x00000000049F0000-0x00000000049F2000-memory.dmp

Filesize
8KB

Download
memory/1380-13-0x0000000004A80000-0x0000000004A81000-memory.dmp

Filesize
4KB

Download
memory/1380-12-0x00000000049F0000-0x00000000049F2000-memory.dmp

Filesize
8KB

Download
memory/1380-16-0x00000000049F0000-0x00000000049F2000-memory.dmp

Filesize
8KB

Download
memory/2196-68-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2196-72-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2196-55-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2196-67-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2196-141-0x0000000000B50000-0x0000000001C0A000-memory.dmp

Filesize
16.7MB

Download
memory/2196-143-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2208-56-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-83-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-22-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-34-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-33-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-8-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-15-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/2208-35-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-36-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-37-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-38-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-39-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-41-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-42-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-24-0x00000000004E0000-0x00000000004E2000-memory.dmp

Filesize
8KB

Download
memory/2208-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2208-19-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-58-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-59-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-31-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-9-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-10-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-20-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-32-0x00000000004E0000-0x00000000004E2000-memory.dmp

Filesize
8KB

Download
memory/2208-110-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2208-94-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-90-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-73-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-75-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-78-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-80-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-11-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-84-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-86-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-87-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2208-88-0x0000000000800000-0x00000000018BA000-memory.dmp

Filesize
16.7MB

Download
memory/2956-62-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/2956-63-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/2956-114-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2956-70-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/4876-65-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4876-118-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4876-71-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4876-49-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download