Analysis
-
max time kernel
81s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 11:46
Static task
static1
Behavioral task
behavioral1
Sample
0a6ed8ade40d8fe4ed395843ab666737b12edc19d823b71d5de8bf1adddd4b2a_NeikiAnalytics.dll
Resource
win7-20240508-en
General
-
Target
0a6ed8ade40d8fe4ed395843ab666737b12edc19d823b71d5de8bf1adddd4b2a_NeikiAnalytics.dll
-
Size
120KB
-
MD5
4a7c1623d0bd5a69e4c2f5f905207050
-
SHA1
2cd3715ed8565274652fc705394818d4f7f2f86c
-
SHA256
0a6ed8ade40d8fe4ed395843ab666737b12edc19d823b71d5de8bf1adddd4b2a
-
SHA512
6a5deae3670f6bbab89641afdf2c45adf006dffac86b45aa6df755bd0b8d09bb18f8fc0815d591607e10b8f17b0c19258edce72e8b323a26578c0a8d51676f24
-
SSDEEP
3072:8U5XtaaL5H/N6PHj4LUQMF88U7ogqbb8CfHo6l39:VVgaLxmDqU+8YogW8CP/N
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
Processes:
e57610c.exee574546.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57610c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57610c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e574546.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e574546.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e574546.exe -
Processes:
e574546.exee57610c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57610c.exe -
Processes:
e574546.exee57610c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57610c.exe -
Executes dropped EXE 4 IoCs
Processes:
e574546.exee57468e.exee57610c.exee57612b.exepid process 1644 e574546.exe 2400 e57468e.exe 4756 e57610c.exe 2060 e57612b.exe -
Processes:
resource yara_rule behavioral2/memory/1644-6-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-9-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-8-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-21-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-16-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-29-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-33-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-32-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-10-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-34-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-35-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-36-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-37-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-38-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-39-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-40-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-42-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-43-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-57-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-59-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-60-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-74-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-76-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-79-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-81-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-82-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-83-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-85-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-87-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-89-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-91-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/1644-97-0x00000000007D0000-0x000000000188A000-memory.dmp upx behavioral2/memory/4756-139-0x0000000000BB0000-0x0000000001C6A000-memory.dmp upx behavioral2/memory/4756-129-0x0000000000BB0000-0x0000000001C6A000-memory.dmp upx -
Processes:
e574546.exee57610c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e574546.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e574546.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57610c.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57610c.exe -
Processes:
e57610c.exee574546.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574546.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e574546.exedescription ioc process File opened (read-only) \??\E: e574546.exe File opened (read-only) \??\N: e574546.exe File opened (read-only) \??\O: e574546.exe File opened (read-only) \??\Q: e574546.exe File opened (read-only) \??\S: e574546.exe File opened (read-only) \??\I: e574546.exe File opened (read-only) \??\K: e574546.exe File opened (read-only) \??\L: e574546.exe File opened (read-only) \??\R: e574546.exe File opened (read-only) \??\M: e574546.exe File opened (read-only) \??\P: e574546.exe File opened (read-only) \??\G: e574546.exe File opened (read-only) \??\H: e574546.exe File opened (read-only) \??\J: e574546.exe -
Drops file in Program Files directory 4 IoCs
Processes:
e574546.exedescription ioc process File opened for modification C:\Program Files\7-Zip\Uninstall.exe e574546.exe File opened for modification C:\Program Files\7-Zip\7z.exe e574546.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e574546.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e574546.exe -
Drops file in Windows directory 3 IoCs
Processes:
e574546.exee57610c.exedescription ioc process File created C:\Windows\e5745a4 e574546.exe File opened for modification C:\Windows\SYSTEM.INI e574546.exe File created C:\Windows\e57af7a e57610c.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e574546.exepid process 1644 e574546.exe 1644 e574546.exe 1644 e574546.exe 1644 e574546.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e574546.exedescription pid process Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe Token: SeDebugPrivilege 1644 e574546.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
rundll32.exerundll32.exee574546.exedescription pid process target process PID 4296 wrote to memory of 3880 4296 rundll32.exe rundll32.exe PID 4296 wrote to memory of 3880 4296 rundll32.exe rundll32.exe PID 4296 wrote to memory of 3880 4296 rundll32.exe rundll32.exe PID 3880 wrote to memory of 1644 3880 rundll32.exe e574546.exe PID 3880 wrote to memory of 1644 3880 rundll32.exe e574546.exe PID 3880 wrote to memory of 1644 3880 rundll32.exe e574546.exe PID 1644 wrote to memory of 776 1644 e574546.exe fontdrvhost.exe PID 1644 wrote to memory of 784 1644 e574546.exe fontdrvhost.exe PID 1644 wrote to memory of 64 1644 e574546.exe dwm.exe PID 1644 wrote to memory of 2408 1644 e574546.exe sihost.exe PID 1644 wrote to memory of 2416 1644 e574546.exe svchost.exe PID 1644 wrote to memory of 2572 1644 e574546.exe taskhostw.exe PID 1644 wrote to memory of 3532 1644 e574546.exe Explorer.EXE PID 1644 wrote to memory of 3696 1644 e574546.exe svchost.exe PID 1644 wrote to memory of 3896 1644 e574546.exe DllHost.exe PID 1644 wrote to memory of 3984 1644 e574546.exe StartMenuExperienceHost.exe PID 1644 wrote to memory of 4048 1644 e574546.exe RuntimeBroker.exe PID 1644 wrote to memory of 2744 1644 e574546.exe SearchApp.exe PID 1644 wrote to memory of 4128 1644 e574546.exe RuntimeBroker.exe PID 1644 wrote to memory of 4056 1644 e574546.exe TextInputHost.exe PID 1644 wrote to memory of 1060 1644 e574546.exe RuntimeBroker.exe PID 1644 wrote to memory of 4296 1644 e574546.exe rundll32.exe PID 1644 wrote to memory of 3880 1644 e574546.exe rundll32.exe PID 1644 wrote to memory of 3880 1644 e574546.exe rundll32.exe PID 3880 wrote to memory of 2400 3880 rundll32.exe e57468e.exe PID 3880 wrote to memory of 2400 3880 rundll32.exe e57468e.exe PID 3880 wrote to memory of 2400 3880 rundll32.exe e57468e.exe PID 3880 wrote to memory of 4756 3880 rundll32.exe e57610c.exe PID 3880 wrote to memory of 4756 3880 rundll32.exe e57610c.exe PID 3880 wrote to memory of 4756 3880 rundll32.exe e57610c.exe PID 3880 wrote to memory of 2060 3880 rundll32.exe e57612b.exe PID 3880 wrote to memory of 2060 3880 rundll32.exe e57612b.exe PID 3880 wrote to memory of 2060 3880 rundll32.exe e57612b.exe PID 1644 wrote to memory of 776 1644 e574546.exe fontdrvhost.exe PID 1644 wrote to memory of 784 1644 e574546.exe fontdrvhost.exe PID 1644 wrote to memory of 64 1644 e574546.exe dwm.exe PID 1644 wrote to memory of 2408 1644 e574546.exe sihost.exe PID 1644 wrote to memory of 2416 1644 e574546.exe svchost.exe PID 1644 wrote to memory of 2572 1644 e574546.exe taskhostw.exe PID 1644 wrote to memory of 3532 1644 e574546.exe Explorer.EXE PID 1644 wrote to memory of 3696 1644 e574546.exe svchost.exe PID 1644 wrote to memory of 3896 1644 e574546.exe DllHost.exe PID 1644 wrote to memory of 3984 1644 e574546.exe StartMenuExperienceHost.exe PID 1644 wrote to memory of 4048 1644 e574546.exe RuntimeBroker.exe PID 1644 wrote to memory of 2744 1644 e574546.exe SearchApp.exe PID 1644 wrote to memory of 4128 1644 e574546.exe RuntimeBroker.exe PID 1644 wrote to memory of 4056 1644 e574546.exe TextInputHost.exe PID 1644 wrote to memory of 1060 1644 e574546.exe RuntimeBroker.exe PID 1644 wrote to memory of 2400 1644 e574546.exe e57468e.exe PID 1644 wrote to memory of 2400 1644 e574546.exe e57468e.exe PID 1644 wrote to memory of 4756 1644 e574546.exe e57610c.exe PID 1644 wrote to memory of 4756 1644 e574546.exe e57610c.exe PID 1644 wrote to memory of 2060 1644 e574546.exe e57612b.exe PID 1644 wrote to memory of 2060 1644 e574546.exe e57612b.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e57610c.exee574546.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57610c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574546.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0a6ed8ade40d8fe4ed395843ab666737b12edc19d823b71d5de8bf1adddd4b2a_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0a6ed8ade40d8fe4ed395843ab666737b12edc19d823b71d5de8bf1adddd4b2a_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e574546.exeC:\Users\Admin\AppData\Local\Temp\e574546.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e57468e.exeC:\Users\Admin\AppData\Local\Temp\e57468e.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e57610c.exeC:\Users\Admin\AppData\Local\Temp\e57610c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e57612b.exeC:\Users\Admin\AppData\Local\Temp\e57612b.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e574546.exeFilesize
97KB
MD5dc15f72c7418dcbec84a25e1e9c4b9fe
SHA1bec9da2a8f6565d4eea95d00fbc6b3aee920cf2c
SHA256c08f9f2b6dd2c0b320fe47cbfd7dab2260b0652c79a5b666d07fb138fa638e53
SHA512b87332c413ad9b70106e1fbc8bb26dfe0a8f3ad4122bc6a3ae2b9bf87be813e346561146549c282119fc1469854832e13a77a98480de0feab28148b440380c53
-
C:\Windows\SYSTEM.INIFilesize
256B
MD5d0209302ae1691888280e8908e590098
SHA137da48f79bda3f6ecc6c77fbc0399a7dcbbf85cc
SHA256607d41ea031da6a26549de72e7fcea6c0b05b010e874f609ee2e8e1222e536e2
SHA512ed63c385462d3830f4d6cf809b443d984c1761a011671655a5964c94d3f877b00fc2fc1022b9118350be500acaeed20efbdabfca7784fee44eea00e6e1db1f95
-
memory/1644-79-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-81-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-9-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-8-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-57-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1644-97-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-31-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1644-30-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1644-111-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1644-21-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-16-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-29-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-33-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-18-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/1644-32-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-10-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-34-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-102-0x00000000005B0000-0x00000000005B2000-memory.dmpFilesize
8KB
-
memory/1644-35-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-36-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-37-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-38-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-39-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-40-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-42-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-43-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-91-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-89-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-87-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-59-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-60-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-85-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-83-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-82-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-6-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-76-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/1644-74-0x00000000007D0000-0x000000000188A000-memory.dmpFilesize
16.7MB
-
memory/2060-70-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2060-137-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2060-73-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2060-69-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2060-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2400-64-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2400-63-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2400-115-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2400-71-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2400-22-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3880-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/3880-11-0x00000000041D0000-0x00000000041D2000-memory.dmpFilesize
8KB
-
memory/3880-23-0x00000000041D0000-0x00000000041D2000-memory.dmpFilesize
8KB
-
memory/3880-12-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/3880-13-0x00000000041D0000-0x00000000041D2000-memory.dmpFilesize
8KB
-
memory/4756-129-0x0000000000BB0000-0x0000000001C6A000-memory.dmpFilesize
16.7MB
-
memory/4756-66-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4756-138-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4756-67-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4756-139-0x0000000000BB0000-0x0000000001C6A000-memory.dmpFilesize
16.7MB
-
memory/4756-50-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4756-72-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB