sality | 80e39a1f768092e7f02f9db73abc465322032d0e4d1dae59600f85cc8a38540e

Analysis

max time kernel
146s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 07:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80e39a1f768092e7f02f9db73abc465322032d0e4d1dae59600f85cc8a38540e_NeikiAnalytics.dll
Size

120KB
MD5

4f94b4da382ef1b4056f17cbc68c7a20
SHA1

5f17f77c47eb722a405ac5fc1ce38caf1d135233
SHA256

80e39a1f768092e7f02f9db73abc465322032d0e4d1dae59600f85cc8a38540e
SHA512

85e67e1d9e579831602e52cd765e8ede6a477036793867b2ff18f648ca69e294a75eee515f5b9e389a15339de589fa47c9b52402e0e20d0e568e3a8e8267a384
SSDEEP

3072:6Uh11a84hkyu/JHnpH5lJoX8kJBjVrwcFYrCJM:6UT1aDkyu/RRhWJ7W+JM

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e575e1e.exee5797cb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e575e1e.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e575e1e.exee5797cb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5797cb.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e5797cb.exee575e1e.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5797cb.exe

Executes dropped EXE 4 IoCs

Processes:

e575e1e.exee57607f.exee5797cb.exee579839.exe

pid process

4428 e575e1e.exe
4024 e57607f.exe
912 e5797cb.exe
4992 e579839.exe

pid	process
4428	e575e1e.exe
4024	e57607f.exe
912	e5797cb.exe
4992	e579839.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4428-6-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-11-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-21-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-15-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-22-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-12-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-9-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-14-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-13-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-8-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-30-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-32-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-34-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-43-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-44-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-46-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-60-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-62-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-63-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-64-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-66-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4428-67-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/912-99-0x0000000000760000-0x000000000181A000-memory.dmp	upx
behavioral2/memory/912-94-0x0000000000760000-0x000000000181A000-memory.dmp	upx
behavioral2/memory/912-93-0x0000000000760000-0x000000000181A000-memory.dmp	upx
behavioral2/memory/912-91-0x0000000000760000-0x000000000181A000-memory.dmp	upx
behavioral2/memory/912-89-0x0000000000760000-0x000000000181A000-memory.dmp	upx
behavioral2/memory/912-95-0x0000000000760000-0x000000000181A000-memory.dmp	upx
behavioral2/memory/912-98-0x0000000000760000-0x000000000181A000-memory.dmp	upx
behavioral2/memory/912-96-0x0000000000760000-0x000000000181A000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e575e1e.exee5797cb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5797cb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5797cb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5797cb.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e575e1e.exee5797cb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5797cb.exe

Enumerates connected drives 3 TTPs 7 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e575e1e.exee5797cb.exe

description	ioc	process
File opened (read-only)	\??\K:	e575e1e.exe
File opened (read-only)	\??\E:	e5797cb.exe
File opened (read-only)	\??\E:	e575e1e.exe
File opened (read-only)	\??\G:	e575e1e.exe
File opened (read-only)	\??\H:	e575e1e.exe
File opened (read-only)	\??\I:	e575e1e.exe
File opened (read-only)	\??\J:	e575e1e.exe

Drops file in Windows directory 3 IoCs

Processes:

e575e1e.exee5797cb.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI e575e1e.exe
File created C:\Windows\e57bf68 e5797cb.exe
File created C:\Windows\e575e7b e575e1e.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e575e1e.exee5797cb.exe

pid process

4428 e575e1e.exe
4428 e575e1e.exe
4428 e575e1e.exe
4428 e575e1e.exe
912 e5797cb.exe
912 e5797cb.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	e575e1e.exe
File created	C:\Windows\e57bf68	e5797cb.exe
File created	C:\Windows\e575e7b	e575e1e.exe

pid	process
4428	e575e1e.exe
4428	e575e1e.exe
4428	e575e1e.exe
4428	e575e1e.exe
912	e5797cb.exe
912	e5797cb.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e575e1e.exe

description	pid	process
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe
Token: SeDebugPrivilege	4428	e575e1e.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exee575e1e.exee5797cb.exe

description	pid	process	target process
PID 964 wrote to memory of 4392	964	rundll32.exe	rundll32.exe
PID 964 wrote to memory of 4392	964	rundll32.exe	rundll32.exe
PID 964 wrote to memory of 4392	964	rundll32.exe	rundll32.exe
PID 4392 wrote to memory of 4428	4392	rundll32.exe	e575e1e.exe
PID 4392 wrote to memory of 4428	4392	rundll32.exe	e575e1e.exe
PID 4392 wrote to memory of 4428	4392	rundll32.exe	e575e1e.exe
PID 4428 wrote to memory of 792	4428	e575e1e.exe	fontdrvhost.exe
PID 4428 wrote to memory of 796	4428	e575e1e.exe	fontdrvhost.exe
PID 4428 wrote to memory of 316	4428	e575e1e.exe	dwm.exe
PID 4428 wrote to memory of 3212	4428	e575e1e.exe	sihost.exe
PID 4428 wrote to memory of 3228	4428	e575e1e.exe	svchost.exe
PID 4428 wrote to memory of 3340	4428	e575e1e.exe	taskhostw.exe
PID 4428 wrote to memory of 3564	4428	e575e1e.exe	Explorer.EXE
PID 4428 wrote to memory of 3724	4428	e575e1e.exe	svchost.exe
PID 4428 wrote to memory of 3912	4428	e575e1e.exe	DllHost.exe
PID 4428 wrote to memory of 4004	4428	e575e1e.exe	StartMenuExperienceHost.exe
PID 4428 wrote to memory of 4068	4428	e575e1e.exe	RuntimeBroker.exe
PID 4428 wrote to memory of 2288	4428	e575e1e.exe	SearchApp.exe
PID 4428 wrote to memory of 4220	4428	e575e1e.exe	RuntimeBroker.exe
PID 4428 wrote to memory of 4816	4428	e575e1e.exe	RuntimeBroker.exe
PID 4428 wrote to memory of 1452	4428	e575e1e.exe	TextInputHost.exe
PID 4428 wrote to memory of 2732	4428	e575e1e.exe	backgroundTaskHost.exe
PID 4428 wrote to memory of 2404	4428	e575e1e.exe	backgroundTaskHost.exe
PID 4428 wrote to memory of 964	4428	e575e1e.exe	rundll32.exe
PID 4428 wrote to memory of 4392	4428	e575e1e.exe	rundll32.exe
PID 4428 wrote to memory of 4392	4428	e575e1e.exe	rundll32.exe
PID 4392 wrote to memory of 4024	4392	rundll32.exe	e57607f.exe
PID 4392 wrote to memory of 4024	4392	rundll32.exe	e57607f.exe
PID 4392 wrote to memory of 4024	4392	rundll32.exe	e57607f.exe
PID 4428 wrote to memory of 792	4428	e575e1e.exe	fontdrvhost.exe
PID 4428 wrote to memory of 796	4428	e575e1e.exe	fontdrvhost.exe
PID 4428 wrote to memory of 316	4428	e575e1e.exe	dwm.exe
PID 4428 wrote to memory of 3212	4428	e575e1e.exe	sihost.exe
PID 4428 wrote to memory of 3228	4428	e575e1e.exe	svchost.exe
PID 4428 wrote to memory of 3340	4428	e575e1e.exe	taskhostw.exe
PID 4428 wrote to memory of 3564	4428	e575e1e.exe	Explorer.EXE
PID 4428 wrote to memory of 3724	4428	e575e1e.exe	svchost.exe
PID 4428 wrote to memory of 3912	4428	e575e1e.exe	DllHost.exe
PID 4428 wrote to memory of 4004	4428	e575e1e.exe	StartMenuExperienceHost.exe
PID 4428 wrote to memory of 4068	4428	e575e1e.exe	RuntimeBroker.exe
PID 4428 wrote to memory of 2288	4428	e575e1e.exe	SearchApp.exe
PID 4428 wrote to memory of 4220	4428	e575e1e.exe	RuntimeBroker.exe
PID 4428 wrote to memory of 4816	4428	e575e1e.exe	RuntimeBroker.exe
PID 4428 wrote to memory of 1452	4428	e575e1e.exe	TextInputHost.exe
PID 4428 wrote to memory of 2732	4428	e575e1e.exe	backgroundTaskHost.exe
PID 4428 wrote to memory of 2404	4428	e575e1e.exe	backgroundTaskHost.exe
PID 4428 wrote to memory of 964	4428	e575e1e.exe	rundll32.exe
PID 4428 wrote to memory of 4024	4428	e575e1e.exe	e57607f.exe
PID 4428 wrote to memory of 4024	4428	e575e1e.exe	e57607f.exe
PID 4392 wrote to memory of 912	4392	rundll32.exe	e5797cb.exe
PID 4392 wrote to memory of 912	4392	rundll32.exe	e5797cb.exe
PID 4392 wrote to memory of 912	4392	rundll32.exe	e5797cb.exe
PID 4392 wrote to memory of 4992	4392	rundll32.exe	e579839.exe
PID 4392 wrote to memory of 4992	4392	rundll32.exe	e579839.exe
PID 4392 wrote to memory of 4992	4392	rundll32.exe	e579839.exe
PID 912 wrote to memory of 792	912	e5797cb.exe	fontdrvhost.exe
PID 912 wrote to memory of 796	912	e5797cb.exe	fontdrvhost.exe
PID 912 wrote to memory of 316	912	e5797cb.exe	dwm.exe
PID 912 wrote to memory of 3212	912	e5797cb.exe	sihost.exe
PID 912 wrote to memory of 3228	912	e5797cb.exe	svchost.exe
PID 912 wrote to memory of 3340	912	e5797cb.exe	taskhostw.exe
PID 912 wrote to memory of 3564	912	e5797cb.exe	Explorer.EXE
PID 912 wrote to memory of 3724	912	e5797cb.exe	svchost.exe
PID 912 wrote to memory of 3912	912	e5797cb.exe	DllHost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e575e1e.exee5797cb.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575e1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5797cb.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:792

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:316

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3228

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3340

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3564

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80e39a1f768092e7f02f9db73abc465322032d0e4d1dae59600f85cc8a38540e_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\80e39a1f768092e7f02f9db73abc465322032d0e4d1dae59600f85cc8a38540e_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:4392

C:\Users\Admin\AppData\Local\Temp\e575e1e.exe
C:\Users\Admin\AppData\Local\Temp\e575e1e.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4428

C:\Users\Admin\AppData\Local\Temp\e57607f.exe
C:\Users\Admin\AppData\Local\Temp\e57607f.exe
4⤵
- Executes dropped EXE
PID:4024

C:\Users\Admin\AppData\Local\Temp\e5797cb.exe
C:\Users\Admin\AppData\Local\Temp\e5797cb.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:912

C:\Users\Admin\AppData\Local\Temp\e579839.exe
C:\Users\Admin\AppData\Local\Temp\e579839.exe
4⤵
- Executes dropped EXE
PID:4992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3724

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3912

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4004

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4068

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2288

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4816

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1452

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2732

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2404

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4704

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e575e1e.exe
Filesize
97KB

MD5
3f664a324913fda2bf792a776356e085

SHA1
fc195655e89fbf7dd0db27cfae7a717ddea266d4

SHA256
bc8b78804854df9818cb406ad7b1c3f2e1fbb2aa8c978e46b8cf7578edd1105e

SHA512
64c27ea109e9e63b372614cd2d93e95d357921a7c12d7e37f2e687301fe68368c867fa7531bd46040e2a0b7c119b0d3fa2dc1500f72eaf09b4dce39e3b41bf62

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
3b9313b794b51d0f8574a3433c2eb698

SHA1
e388b170feede1740e968a4c160098cddf1d41b5

SHA256
25383012048f82664ebc9c6140a109943a7db5681c2a133cd74daa699006bc06

SHA512
ddbcc9bceae74417bca3b2a79917cd7017f90db55c0b82e8de13908734152b76353e28b2675ac193036fbbe407c161ba22e3cef5f9beb9c3b2f91a14e2710a5a

Download Submit
memory/912-98-0x0000000000760000-0x000000000181A000-memory.dmp

Filesize
16.7MB

Download
memory/912-139-0x00007FFCDE370000-0x00007FFCDE565000-memory.dmp

Filesize
2.0MB

Download
memory/912-52-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/912-96-0x0000000000760000-0x000000000181A000-memory.dmp

Filesize
16.7MB

Download
memory/912-93-0x0000000000760000-0x000000000181A000-memory.dmp

Filesize
16.7MB

Download
memory/912-138-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/912-95-0x0000000000760000-0x000000000181A000-memory.dmp

Filesize
16.7MB

Download
memory/912-89-0x0000000000760000-0x000000000181A000-memory.dmp

Filesize
16.7MB

Download
memory/912-91-0x0000000000760000-0x000000000181A000-memory.dmp

Filesize
16.7MB

Download
memory/912-100-0x00007FFCDE370000-0x00007FFCDE565000-memory.dmp

Filesize
2.0MB

Download
memory/912-99-0x0000000000760000-0x000000000181A000-memory.dmp

Filesize
16.7MB

Download
memory/912-94-0x0000000000760000-0x000000000181A000-memory.dmp

Filesize
16.7MB

Download
memory/4024-117-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4024-40-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4024-41-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4024-38-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4024-42-0x00007FFCDE370000-0x00007FFCDE565000-memory.dmp

Filesize
2.0MB

Download
memory/4392-24-0x00000000040C0000-0x00000000040C2000-memory.dmp

Filesize
8KB

Download
memory/4392-31-0x00007FFCDE370000-0x00007FFCDE565000-memory.dmp

Filesize
2.0MB

Download
memory/4392-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/4392-54-0x00000000040C0000-0x00000000040C2000-memory.dmp

Filesize
8KB

Download
memory/4392-23-0x00000000040C0000-0x00000000040C2000-memory.dmp

Filesize
8KB

Download
memory/4392-26-0x0000000004610000-0x0000000004611000-memory.dmp

Filesize
4KB

Download
memory/4428-43-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-28-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/4428-32-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-30-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-44-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-46-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-33-0x00007FFCDE370000-0x00007FFCDE565000-memory.dmp

Filesize
2.0MB

Download
memory/4428-8-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-4-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4428-60-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-62-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-63-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-64-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-66-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-67-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-88-0x00007FFCDE370000-0x00007FFCDE565000-memory.dmp

Filesize
2.0MB

Download
memory/4428-87-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4428-68-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/4428-13-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-14-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-9-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-12-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-34-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-29-0x0000000003520000-0x0000000003522000-memory.dmp

Filesize
8KB

Download
memory/4428-22-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-15-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-21-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-11-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-6-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4428-10-0x00007FFCDE370000-0x00007FFCDE565000-memory.dmp

Filesize
2.0MB

Download
memory/4992-59-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4992-143-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download