Analysis
-
max time kernel
27s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 20:45
Static task
static1
Behavioral task
behavioral1
Sample
1860930a81d9618d1ad1c20a39adba467b409c3d22924ce5919932f102bfe3d9_NeikiAnalytics.dll
Resource
win7-20240419-en
General
-
Target
1860930a81d9618d1ad1c20a39adba467b409c3d22924ce5919932f102bfe3d9_NeikiAnalytics.dll
-
Size
120KB
-
MD5
855a6dc3465d392a7549e8e5a8b377c0
-
SHA1
dcd7ac8a2a24217dbfa2532d8fa9cb04cd8859d2
-
SHA256
1860930a81d9618d1ad1c20a39adba467b409c3d22924ce5919932f102bfe3d9
-
SHA512
81483871dfc3dfb517a0b86cc387403207775026917a2f521a321d731953dae3849b8787193b724a7a90bfbab4bb03615cc2715a8a68ed0f0611416284d75f44
-
SSDEEP
1536:KQ7U7CSpMllfEJepPJHUWssFT2SGiSKPTBG4xRY7s++wjY9iupV9o:KkOSpJHB8SGiSQTBG4XawXLo
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
e57f5ba.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e57f5ba.exe -
Processes:
e57f5ba.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f5ba.exe -
Processes:
e57f5ba.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57f5ba.exe -
Executes dropped EXE 4 IoCs
Processes:
e57f5ba.exee57f741.exee58119f.exee5811ae.exepid process 3416 e57f5ba.exe 5092 e57f741.exe 1944 e58119f.exe 3496 e5811ae.exe -
Processes:
resource yara_rule behavioral2/memory/3416-8-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-11-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-9-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-30-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-34-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-35-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-22-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-13-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-12-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-10-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-6-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-36-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-37-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-38-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-39-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-40-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-42-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-43-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-57-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-59-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-60-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-74-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-76-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-79-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-81-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-83-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-85-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-87-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-90-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-92-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3416-94-0x0000000000840000-0x00000000018FA000-memory.dmp upx behavioral2/memory/3496-133-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx -
Processes:
e57f5ba.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e57f5ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e57f5ba.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e57f5ba.exe -
Processes:
e57f5ba.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f5ba.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
e57f5ba.exedescription ioc process File opened (read-only) \??\N: e57f5ba.exe File opened (read-only) \??\E: e57f5ba.exe File opened (read-only) \??\H: e57f5ba.exe File opened (read-only) \??\I: e57f5ba.exe File opened (read-only) \??\L: e57f5ba.exe File opened (read-only) \??\Q: e57f5ba.exe File opened (read-only) \??\M: e57f5ba.exe File opened (read-only) \??\G: e57f5ba.exe File opened (read-only) \??\J: e57f5ba.exe File opened (read-only) \??\K: e57f5ba.exe File opened (read-only) \??\O: e57f5ba.exe File opened (read-only) \??\P: e57f5ba.exe File opened (read-only) \??\R: e57f5ba.exe File opened (read-only) \??\S: e57f5ba.exe -
Drops file in Program Files directory 4 IoCs
Processes:
e57f5ba.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe e57f5ba.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe e57f5ba.exe File opened for modification C:\Program Files\7-Zip\7zG.exe e57f5ba.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe e57f5ba.exe -
Drops file in Windows directory 2 IoCs
Processes:
e57f5ba.exedescription ioc process File created C:\Windows\e57f5f9 e57f5ba.exe File opened for modification C:\Windows\SYSTEM.INI e57f5ba.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
e57f5ba.exepid process 3416 e57f5ba.exe 3416 e57f5ba.exe 3416 e57f5ba.exe 3416 e57f5ba.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
e57f5ba.exedescription pid process Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe Token: SeDebugPrivilege 3416 e57f5ba.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exerundll32.exee57f5ba.exedescription pid process target process PID 4496 wrote to memory of 4080 4496 rundll32.exe rundll32.exe PID 4496 wrote to memory of 4080 4496 rundll32.exe rundll32.exe PID 4496 wrote to memory of 4080 4496 rundll32.exe rundll32.exe PID 4080 wrote to memory of 3416 4080 rundll32.exe e57f5ba.exe PID 4080 wrote to memory of 3416 4080 rundll32.exe e57f5ba.exe PID 4080 wrote to memory of 3416 4080 rundll32.exe e57f5ba.exe PID 3416 wrote to memory of 772 3416 e57f5ba.exe fontdrvhost.exe PID 3416 wrote to memory of 780 3416 e57f5ba.exe fontdrvhost.exe PID 3416 wrote to memory of 1016 3416 e57f5ba.exe dwm.exe PID 3416 wrote to memory of 2520 3416 e57f5ba.exe sihost.exe PID 3416 wrote to memory of 2560 3416 e57f5ba.exe svchost.exe PID 3416 wrote to memory of 2648 3416 e57f5ba.exe taskhostw.exe PID 3416 wrote to memory of 3524 3416 e57f5ba.exe Explorer.EXE PID 3416 wrote to memory of 3648 3416 e57f5ba.exe svchost.exe PID 3416 wrote to memory of 3836 3416 e57f5ba.exe DllHost.exe PID 3416 wrote to memory of 3980 3416 e57f5ba.exe StartMenuExperienceHost.exe PID 3416 wrote to memory of 4048 3416 e57f5ba.exe RuntimeBroker.exe PID 3416 wrote to memory of 940 3416 e57f5ba.exe SearchApp.exe PID 3416 wrote to memory of 3952 3416 e57f5ba.exe RuntimeBroker.exe PID 3416 wrote to memory of 2436 3416 e57f5ba.exe TextInputHost.exe PID 3416 wrote to memory of 5096 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 4000 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 1884 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 4756 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 4512 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 1912 3416 e57f5ba.exe RuntimeBroker.exe PID 3416 wrote to memory of 4496 3416 e57f5ba.exe rundll32.exe PID 3416 wrote to memory of 4080 3416 e57f5ba.exe rundll32.exe PID 3416 wrote to memory of 4080 3416 e57f5ba.exe rundll32.exe PID 4080 wrote to memory of 5092 4080 rundll32.exe e57f741.exe PID 4080 wrote to memory of 5092 4080 rundll32.exe e57f741.exe PID 4080 wrote to memory of 5092 4080 rundll32.exe e57f741.exe PID 4080 wrote to memory of 1944 4080 rundll32.exe e58119f.exe PID 4080 wrote to memory of 1944 4080 rundll32.exe e58119f.exe PID 4080 wrote to memory of 1944 4080 rundll32.exe e58119f.exe PID 4080 wrote to memory of 3496 4080 rundll32.exe e5811ae.exe PID 4080 wrote to memory of 3496 4080 rundll32.exe e5811ae.exe PID 4080 wrote to memory of 3496 4080 rundll32.exe e5811ae.exe PID 3416 wrote to memory of 772 3416 e57f5ba.exe fontdrvhost.exe PID 3416 wrote to memory of 780 3416 e57f5ba.exe fontdrvhost.exe PID 3416 wrote to memory of 1016 3416 e57f5ba.exe dwm.exe PID 3416 wrote to memory of 2520 3416 e57f5ba.exe sihost.exe PID 3416 wrote to memory of 2560 3416 e57f5ba.exe svchost.exe PID 3416 wrote to memory of 2648 3416 e57f5ba.exe taskhostw.exe PID 3416 wrote to memory of 3524 3416 e57f5ba.exe Explorer.EXE PID 3416 wrote to memory of 3648 3416 e57f5ba.exe svchost.exe PID 3416 wrote to memory of 3836 3416 e57f5ba.exe DllHost.exe PID 3416 wrote to memory of 3980 3416 e57f5ba.exe StartMenuExperienceHost.exe PID 3416 wrote to memory of 4048 3416 e57f5ba.exe RuntimeBroker.exe PID 3416 wrote to memory of 940 3416 e57f5ba.exe SearchApp.exe PID 3416 wrote to memory of 3952 3416 e57f5ba.exe RuntimeBroker.exe PID 3416 wrote to memory of 2436 3416 e57f5ba.exe TextInputHost.exe PID 3416 wrote to memory of 5096 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 4000 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 1884 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 4756 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 4512 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 1912 3416 e57f5ba.exe RuntimeBroker.exe PID 3416 wrote to memory of 5092 3416 e57f5ba.exe e57f741.exe PID 3416 wrote to memory of 5092 3416 e57f5ba.exe e57f741.exe PID 3416 wrote to memory of 3340 3416 e57f5ba.exe msedge.exe PID 3416 wrote to memory of 1944 3416 e57f5ba.exe e58119f.exe PID 3416 wrote to memory of 1944 3416 e57f5ba.exe e58119f.exe PID 3416 wrote to memory of 3496 3416 e57f5ba.exe e5811ae.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
e57f5ba.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e57f5ba.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1860930a81d9618d1ad1c20a39adba467b409c3d22924ce5919932f102bfe3d9_NeikiAnalytics.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1860930a81d9618d1ad1c20a39adba467b409c3d22924ce5919932f102bfe3d9_NeikiAnalytics.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e57f5ba.exeC:\Users\Admin\AppData\Local\Temp\e57f5ba.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e57f741.exeC:\Users\Admin\AppData\Local\Temp\e57f741.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e58119f.exeC:\Users\Admin\AppData\Local\Temp\e58119f.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e5811ae.exeC:\Users\Admin\AppData\Local\Temp\e5811ae.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8390dceb8,0x7ff8390dcec4,0x7ff8390dced02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2264,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1948,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2400,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3416,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:82⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e57f5ba.exeFilesize
97KB
MD5672637f42b2b85decfa10a23fa2c82e6
SHA169032c4f521f611715404359f90e96202d5991f5
SHA2569893035f1a19bf14571e71218ced7f1745714955bd47f453547dda0a1787d4bc
SHA5129933e26cdb919e1e617b6c9c1aaf2e2b74047d663c55abd172b650f471ca2153421a02848e20c1e265673866f254ee98311943e2e0ec803461053ef76ccdde45
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5ef8d4ac12da326b8d5f5a3867fdb310d
SHA1848c93aa785796d93af8fec8ffb7c37ed8cad123
SHA2567d4462cea2d960a86c924b5982cac499d1b8bc283e06982bb22847f5e9c0d2b7
SHA512029894a7aad44c073386d037b8b743d0485e7f08b606858c1a78398394a262c4c39f12da39aba7ad21577e3eb3f5c5d827c288b5d67c02a78625aa70030d658f
-
memory/1944-120-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1944-65-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1944-69-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1944-72-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1944-50-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3416-42-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-59-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-22-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-13-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-29-0x0000000000560000-0x0000000000562000-memory.dmpFilesize
8KB
-
memory/3416-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3416-23-0x0000000000560000-0x0000000000562000-memory.dmpFilesize
8KB
-
memory/3416-12-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-10-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-18-0x0000000001C00000-0x0000000001C01000-memory.dmpFilesize
4KB
-
memory/3416-8-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-112-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3416-94-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-6-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-36-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-37-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-92-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-38-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-39-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-40-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-34-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-43-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-30-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-90-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-57-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-35-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-60-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-89-0x0000000000560000-0x0000000000562000-memory.dmpFilesize
8KB
-
memory/3416-87-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-85-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-9-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-83-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-11-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-81-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-79-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-74-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3416-76-0x0000000000840000-0x00000000018FA000-memory.dmpFilesize
16.7MB
-
memory/3496-68-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3496-135-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3496-133-0x0000000000B70000-0x0000000001C2A000-memory.dmpFilesize
16.7MB
-
memory/3496-73-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3496-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4080-15-0x0000000004050000-0x0000000004051000-memory.dmpFilesize
4KB
-
memory/4080-28-0x0000000000D40000-0x0000000000D42000-memory.dmpFilesize
8KB
-
memory/4080-0-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/4080-14-0x0000000000D40000-0x0000000000D42000-memory.dmpFilesize
8KB
-
memory/4080-16-0x0000000000D40000-0x0000000000D42000-memory.dmpFilesize
8KB
-
memory/5092-71-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/5092-116-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/5092-32-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/5092-63-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/5092-66-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB