sality | b064e4d47eaf54123cedd70576c480f26e50676552d611f381184f87d31ac3ee

Analysis

max time kernel
141s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29-06-2024 15:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b064e4d47eaf54123cedd70576c480f26e50676552d611f381184f87d31ac3ee_NeikiAnalytics.dll
Size

120KB
MD5

959f6e3872de1c2c46cb5ab255d9e230
SHA1

281ddb475e97ecc9b6ea55130f598ada6861a50c
SHA256

b064e4d47eaf54123cedd70576c480f26e50676552d611f381184f87d31ac3ee
SHA512

6856d6d867a1f35ae8c48835d220d9228ff26607e32666f8d03507ce4aebdb6003d54aa10629b41fabf5d5786b66b3b20d42d921f544f322a5839680252f11ac
SSDEEP

3072:xobMMkfLUJeCuP1bh4OAbkFd2+FO85lKpwvxbQqUiz:mIpfLBbhHAb8Z7aCvZ1Ui

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e575d62.exee578165.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e578165.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e575d62.exee578165.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578165.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e578165.exee575d62.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e578165.exe

Executes dropped EXE 3 IoCs

Processes:

e575d62.exee575e5c.exee578165.exe

pid process

1836 e575d62.exe
3552 e575e5c.exe
3604 e578165.exe

pid	process
1836	e575d62.exe
3552	e575e5c.exe
3604	e578165.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1836-6-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-10-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-8-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-11-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-12-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-27-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-32-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-28-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-31-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-9-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-36-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-37-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-38-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-39-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-40-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-42-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-43-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-53-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-62-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-63-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-65-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-68-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-70-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-72-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-73-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-75-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-74-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-76-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/1836-77-0x0000000000860000-0x000000000191A000-memory.dmp	upx
behavioral2/memory/3604-117-0x0000000000B30000-0x0000000001BEA000-memory.dmp	upx
behavioral2/memory/3604-131-0x0000000000B30000-0x0000000001BEA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e578165.exee575d62.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e578165.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e575d62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e578165.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e578165.exee575d62.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578165.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575d62.exe

Enumerates connected drives 3 TTPs 11 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e575d62.exe

description	ioc	process
File opened (read-only)	\??\M:	e575d62.exe
File opened (read-only)	\??\O:	e575d62.exe
File opened (read-only)	\??\L:	e575d62.exe
File opened (read-only)	\??\N:	e575d62.exe
File opened (read-only)	\??\E:	e575d62.exe
File opened (read-only)	\??\G:	e575d62.exe
File opened (read-only)	\??\H:	e575d62.exe
File opened (read-only)	\??\I:	e575d62.exe
File opened (read-only)	\??\J:	e575d62.exe
File opened (read-only)	\??\K:	e575d62.exe
File opened (read-only)	\??\P:	e575d62.exe

Drops file in Program Files directory 3 IoCs

Processes:

e575d62.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e575d62.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e575d62.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e575d62.exe

Drops file in Windows directory 3 IoCs

Processes:

e575d62.exee578165.exe

description ioc process

File created C:\Windows\e575dcf e575d62.exe
File opened for modification C:\Windows\SYSTEM.INI e575d62.exe
File created C:\Windows\e57d188 e578165.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

e575d62.exee578165.exe

pid process

1836 e575d62.exe
1836 e575d62.exe
1836 e575d62.exe
1836 e575d62.exe
3604 e578165.exe
3604 e578165.exe

description	ioc	process
File created	C:\Windows\e575dcf	e575d62.exe
File opened for modification	C:\Windows\SYSTEM.INI	e575d62.exe
File created	C:\Windows\e57d188	e578165.exe

pid	process
1836	e575d62.exe
1836	e575d62.exe
1836	e575d62.exe
1836	e575d62.exe
3604	e578165.exe
3604	e578165.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e575d62.exe

description	pid	process
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe
Token: SeDebugPrivilege	1836	e575d62.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exerundll32.exee575d62.exee578165.exe

description	pid	process	target process
PID 1936 wrote to memory of 848	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 848	1936	rundll32.exe	rundll32.exe
PID 1936 wrote to memory of 848	1936	rundll32.exe	rundll32.exe
PID 848 wrote to memory of 1836	848	rundll32.exe	e575d62.exe
PID 848 wrote to memory of 1836	848	rundll32.exe	e575d62.exe
PID 848 wrote to memory of 1836	848	rundll32.exe	e575d62.exe
PID 1836 wrote to memory of 808	1836	e575d62.exe	fontdrvhost.exe
PID 1836 wrote to memory of 812	1836	e575d62.exe	fontdrvhost.exe
PID 1836 wrote to memory of 380	1836	e575d62.exe	dwm.exe
PID 1836 wrote to memory of 2652	1836	e575d62.exe	sihost.exe
PID 1836 wrote to memory of 2664	1836	e575d62.exe	svchost.exe
PID 1836 wrote to memory of 2868	1836	e575d62.exe	taskhostw.exe
PID 1836 wrote to memory of 3368	1836	e575d62.exe	Explorer.EXE
PID 1836 wrote to memory of 3516	1836	e575d62.exe	svchost.exe
PID 1836 wrote to memory of 3708	1836	e575d62.exe	DllHost.exe
PID 1836 wrote to memory of 3796	1836	e575d62.exe	StartMenuExperienceHost.exe
PID 1836 wrote to memory of 3868	1836	e575d62.exe	RuntimeBroker.exe
PID 1836 wrote to memory of 3992	1836	e575d62.exe	SearchApp.exe
PID 1836 wrote to memory of 3404	1836	e575d62.exe	RuntimeBroker.exe
PID 1836 wrote to memory of 2492	1836	e575d62.exe	RuntimeBroker.exe
PID 1836 wrote to memory of 2552	1836	e575d62.exe	TextInputHost.exe
PID 1836 wrote to memory of 540	1836	e575d62.exe	backgroundTaskHost.exe
PID 1836 wrote to memory of 1764	1836	e575d62.exe	backgroundTaskHost.exe
PID 1836 wrote to memory of 1936	1836	e575d62.exe	rundll32.exe
PID 1836 wrote to memory of 848	1836	e575d62.exe	rundll32.exe
PID 1836 wrote to memory of 848	1836	e575d62.exe	rundll32.exe
PID 848 wrote to memory of 3552	848	rundll32.exe	e575e5c.exe
PID 848 wrote to memory of 3552	848	rundll32.exe	e575e5c.exe
PID 848 wrote to memory of 3552	848	rundll32.exe	e575e5c.exe
PID 848 wrote to memory of 3604	848	rundll32.exe	e578165.exe
PID 848 wrote to memory of 3604	848	rundll32.exe	e578165.exe
PID 848 wrote to memory of 3604	848	rundll32.exe	e578165.exe
PID 1836 wrote to memory of 808	1836	e575d62.exe	fontdrvhost.exe
PID 1836 wrote to memory of 812	1836	e575d62.exe	fontdrvhost.exe
PID 1836 wrote to memory of 380	1836	e575d62.exe	dwm.exe
PID 1836 wrote to memory of 2652	1836	e575d62.exe	sihost.exe
PID 1836 wrote to memory of 2664	1836	e575d62.exe	svchost.exe
PID 1836 wrote to memory of 2868	1836	e575d62.exe	taskhostw.exe
PID 1836 wrote to memory of 3368	1836	e575d62.exe	Explorer.EXE
PID 1836 wrote to memory of 3516	1836	e575d62.exe	svchost.exe
PID 1836 wrote to memory of 3708	1836	e575d62.exe	DllHost.exe
PID 1836 wrote to memory of 3796	1836	e575d62.exe	StartMenuExperienceHost.exe
PID 1836 wrote to memory of 3868	1836	e575d62.exe	RuntimeBroker.exe
PID 1836 wrote to memory of 3992	1836	e575d62.exe	SearchApp.exe
PID 1836 wrote to memory of 3404	1836	e575d62.exe	RuntimeBroker.exe
PID 1836 wrote to memory of 2492	1836	e575d62.exe	RuntimeBroker.exe
PID 1836 wrote to memory of 2552	1836	e575d62.exe	TextInputHost.exe
PID 1836 wrote to memory of 540	1836	e575d62.exe	backgroundTaskHost.exe
PID 1836 wrote to memory of 1764	1836	e575d62.exe	backgroundTaskHost.exe
PID 1836 wrote to memory of 3552	1836	e575d62.exe	e575e5c.exe
PID 1836 wrote to memory of 3552	1836	e575d62.exe	e575e5c.exe
PID 1836 wrote to memory of 3088	1836	e575d62.exe	RuntimeBroker.exe
PID 1836 wrote to memory of 3148	1836	e575d62.exe	RuntimeBroker.exe
PID 1836 wrote to memory of 3604	1836	e575d62.exe	e578165.exe
PID 1836 wrote to memory of 3604	1836	e575d62.exe	e578165.exe
PID 3604 wrote to memory of 808	3604	e578165.exe	fontdrvhost.exe
PID 3604 wrote to memory of 812	3604	e578165.exe	fontdrvhost.exe
PID 3604 wrote to memory of 380	3604	e578165.exe	dwm.exe
PID 3604 wrote to memory of 2652	3604	e578165.exe	sihost.exe
PID 3604 wrote to memory of 2664	3604	e578165.exe	svchost.exe
PID 3604 wrote to memory of 2868	3604	e578165.exe	taskhostw.exe
PID 3604 wrote to memory of 3368	3604	e578165.exe	Explorer.EXE
PID 3604 wrote to memory of 3516	3604	e578165.exe	svchost.exe
PID 3604 wrote to memory of 3708	3604	e578165.exe	DllHost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e575d62.exee578165.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e575d62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e578165.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:808

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:812

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:380

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2664

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2868

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3368

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b064e4d47eaf54123cedd70576c480f26e50676552d611f381184f87d31ac3ee_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b064e4d47eaf54123cedd70576c480f26e50676552d611f381184f87d31ac3ee_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Users\Admin\AppData\Local\Temp\e575d62.exe
C:\Users\Admin\AppData\Local\Temp\e575d62.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1836

C:\Users\Admin\AppData\Local\Temp\e575e5c.exe
C:\Users\Admin\AppData\Local\Temp\e575e5c.exe
4⤵
- Executes dropped EXE
PID:3552

C:\Users\Admin\AppData\Local\Temp\e578165.exe
C:\Users\Admin\AppData\Local\Temp\e578165.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3516

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3708

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3796

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3868

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3992

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3404

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2492

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2552

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:540

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1764

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3148

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e575d62.exe
Filesize
97KB

MD5
193e053a835a698d78894dc256459b59

SHA1
33cfff226050220b3fdaee30a4e7ef0cfeae4d38

SHA256
5ac9110bce19897027dc3c8a2bd17de961ebc5b4668bd86b5ccdb253deeb6b50

SHA512
b934dac8a366b7868101ef9416f9a75f89da7e7c06f73069f15369d1b060b0c7148e345710827556e6bd629ff66ee60e29acf3b01117fb16cbe2b20a7e4ca6f7

Download Submit
C:\Windows\SYSTEM.INI
Filesize
256B

MD5
3845f3dff7f834db0912022bf559cc42

SHA1
2285c06828ccc12082cda9a2fe7a088813f6dbb4

SHA256
91d62703637412c95c385f9b68c123b6e16e30369d092e6df54e10810124358a

SHA512
3615dab61ae2c303d4959d8c439b4ad1c95fcc8c9f683c44c8f955a9f62ca4868638ffb92343310b0f8ac9850e4f975dcb1ba3a7e69347487a7c7fe4e1d866e6

Download Submit
memory/848-13-0x0000000003F70000-0x0000000003F72000-memory.dmp

Filesize
8KB

Download
memory/848-0-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/848-26-0x0000000004610000-0x0000000004611000-memory.dmp

Filesize
4KB

Download
memory/848-25-0x0000000003F70000-0x0000000003F72000-memory.dmp

Filesize
8KB

Download
memory/848-19-0x0000000003F70000-0x0000000003F72000-memory.dmp

Filesize
8KB

Download
memory/1836-36-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-40-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-11-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-12-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-27-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-32-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-28-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-31-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-30-0x0000000000630000-0x0000000000632000-memory.dmp

Filesize
8KB

Download
memory/1836-29-0x0000000000630000-0x0000000000632000-memory.dmp

Filesize
8KB

Download
memory/1836-9-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-16-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/1836-10-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-73-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-37-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-38-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-39-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-8-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-42-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-6-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1836-43-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-53-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-100-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1836-86-0x0000000000630000-0x0000000000632000-memory.dmp

Filesize
8KB

Download
memory/1836-77-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-76-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-74-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-75-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-62-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-63-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-65-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-68-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-70-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/1836-72-0x0000000000860000-0x000000000191A000-memory.dmp

Filesize
16.7MB

Download
memory/3552-35-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3552-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/3552-55-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/3552-58-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/3552-99-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3604-61-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/3604-57-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/3604-59-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/3604-51-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3604-117-0x0000000000B30000-0x0000000001BEA000-memory.dmp

Filesize
16.7MB

Download
memory/3604-130-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3604-131-0x0000000000B30000-0x0000000001BEA000-memory.dmp

Filesize
16.7MB

Download