Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 04:39
Behavioral task
behavioral1
Sample
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe
-
Size
36KB
-
MD5
5f500bf425159642df0533f6cc76ad70
-
SHA1
5b0f9d99b7c10092fa3579eee44dd4ef30a2e18d
-
SHA256
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01
-
SHA512
e11d34dca0d0d73a1cd40e91574cda0cb4a0f70c6b1032713b5e22560fec3cbb1c38bb9aa7ff6bb4f2762454dfa2bd18cf12add1d847ef14d255ac8a9703cf9e
-
SSDEEP
768:+mfjwQzmBOYMZeQEDNpPv0c3q7QZJxhJkn4l11uy:+mjzm8vzsEZaJxhS4Buy
Malware Config
Signatures
-
Detect Blackmoon payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/388-45-0x0000000000400000-0x0000000000D0A000-memory.dmp family_blackmoon behavioral2/memory/388-13546-0x0000000000400000-0x0000000000D0A000-memory.dmp family_blackmoon behavioral2/memory/388-13548-0x0000000000400000-0x0000000000D0A000-memory.dmp family_blackmoon C:\Windows\Temp\Wmicc.exe family_blackmoon behavioral2/memory/388-13557-0x0000000000400000-0x0000000000D0A000-memory.dmp family_blackmoon behavioral2/memory/388-13576-0x0000000000400000-0x0000000000D0A000-memory.dmp family_blackmoon \??\c:\users\admin\appdata\roaming\graphicsperfsvcs.dll family_blackmoon behavioral2/memory/3332-13580-0x0000000000400000-0x0000000001BF5000-memory.dmp family_blackmoon behavioral2/memory/388-13727-0x0000000000400000-0x0000000000D0A000-memory.dmp family_blackmoon behavioral2/memory/388-13734-0x0000000000400000-0x0000000000D0A000-memory.dmp family_blackmoon behavioral2/memory/388-13740-0x0000000000400000-0x0000000000D0A000-memory.dmp family_blackmoon behavioral2/memory/388-13771-0x0000000000400000-0x0000000000D0A000-memory.dmp family_blackmoon -
Gh0st RAT payload 6 IoCs
Processes:
resource yara_rule \??\c:\users\admin\appdata\roaming\graphicsperfsvcs.dll family_gh0strat behavioral2/memory/3332-13580-0x0000000000400000-0x0000000001BF5000-memory.dmp family_gh0strat behavioral2/memory/3408-13584-0x0000000000400000-0x000000000042A000-memory.dmp family_gh0strat behavioral2/memory/3408-13583-0x0000000000400000-0x000000000042A000-memory.dmp family_gh0strat behavioral2/memory/3408-13582-0x0000000000400000-0x000000000042A000-memory.dmp family_gh0strat behavioral2/memory/3408-13586-0x0000000000400000-0x000000000042A000-memory.dmp family_gh0strat -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 12 IoCs
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exepid process 7924 netsh.exe 2736 netsh.exe 7520 netsh.exe 7940 netsh.exe 7980 netsh.exe 624 netsh.exe 7692 netsh.exe 6176 netsh.exe 2212 netsh.exe 5904 netsh.exe 7308 netsh.exe 4508 netsh.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
Hooks.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\GraphicsPerfSvcs\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Roaming\\GraphicsPerfSvcs.dll" Hooks.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000\Control Panel\International\Geo\Nation 360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe -
Executes dropped EXE 7 IoCs
Processes:
MpMgSvc.exeWmicc.exeGetPassword.exeHooks.exectfmoon.exeMeson.exetraffmonetizer.exepid process 388 MpMgSvc.exe 6756 Wmicc.exe 6524 GetPassword.exe 3332 Hooks.exe 4528 ctfmoon.exe 5952 Meson.exe 6240 traffmonetizer.exe -
Loads dropped DLL 1 IoCs
Processes:
svchost.exepid process 5352 svchost.exe -
Processes:
resource yara_rule C:\Windows\Temp\MpMgSvc.exe upx behavioral2/memory/388-18-0x0000000000400000-0x0000000000D0A000-memory.dmp upx behavioral2/memory/388-45-0x0000000000400000-0x0000000000D0A000-memory.dmp upx behavioral2/memory/388-13546-0x0000000000400000-0x0000000000D0A000-memory.dmp upx behavioral2/memory/388-13548-0x0000000000400000-0x0000000000D0A000-memory.dmp upx behavioral2/memory/388-13557-0x0000000000400000-0x0000000000D0A000-memory.dmp upx C:\Windows\Temp\Hooks.exe upx behavioral2/memory/388-13576-0x0000000000400000-0x0000000000D0A000-memory.dmp upx behavioral2/memory/3332-13577-0x0000000000400000-0x0000000001BF5000-memory.dmp upx behavioral2/memory/3332-13580-0x0000000000400000-0x0000000001BF5000-memory.dmp upx behavioral2/memory/388-13727-0x0000000000400000-0x0000000000D0A000-memory.dmp upx behavioral2/memory/388-13734-0x0000000000400000-0x0000000000D0A000-memory.dmp upx behavioral2/memory/388-13740-0x0000000000400000-0x0000000000D0A000-memory.dmp upx behavioral2/memory/388-13771-0x0000000000400000-0x0000000000D0A000-memory.dmp upx -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 1.226.84.135 Destination IP 1.226.84.135 -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18156 api6.my-ip.io -
Drops file in System32 directory 9 IoCs
Processes:
svchost.exetraffmonetizer.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\64[1].jpg svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\storage.json traffmonetizer.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Update[1].txt svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\pid traffmonetizer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 5352 set thread context of 3408 5352 svchost.exe svchost.exe -
Drops file in Windows directory 64 IoCs
Processes:
svchost.exeMeson.exedescription ioc process File created C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.ReaderWriter.dll svchost.exe File created C:\Windows\Microsoft.NET\ctfmoon.exe svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Primitives.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Numerics.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe.config svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.Client.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Handles.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.IO.MemoryMappedFiles.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Text.RegularExpressions.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Thread.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Writer.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.InteropServices.RuntimeInformation.dll svchost.exe File created C:\Windows\Microsoft.NET\root_conf\default.toml svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\Base.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.Reader.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe svchost.exe File created C:\Windows\Microsoft.NET\.node_id Meson.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.X509Certificates.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NetworkInformation.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Primitives.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Json.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Claims.dll svchost.exe File created C:\Windows\Microsoft.NET\Meson.exe svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll svchost.exe File created C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 6464 2604 WerFault.exe 360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
Meson.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" Meson.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2002 = "Cabo Verde Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" Meson.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" Meson.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
MpMgSvc.exeGetPassword.exepowershell.exesvchost.exepid process 388 MpMgSvc.exe 388 MpMgSvc.exe 388 MpMgSvc.exe 388 MpMgSvc.exe 388 MpMgSvc.exe 388 MpMgSvc.exe 6524 GetPassword.exe 6524 GetPassword.exe 6944 powershell.exe 6944 powershell.exe 6944 powershell.exe 5352 svchost.exe 5352 svchost.exe 5352 svchost.exe 5352 svchost.exe 5352 svchost.exe 5352 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
svchost.exepid process 3408 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
GetPassword.exepowershell.exetraffmonetizer.exedescription pid process Token: SeDebugPrivilege 6524 GetPassword.exe Token: SeDebugPrivilege 6944 powershell.exe Token: SeDebugPrivilege 6240 traffmonetizer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
traffmonetizer.exepid process 6240 traffmonetizer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MpMgSvc.exeWmicc.exeHooks.exepid process 388 MpMgSvc.exe 388 MpMgSvc.exe 6756 Wmicc.exe 3332 Hooks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exeMpMgSvc.exeWmicc.execmd.exeHooks.exesvchost.exedescription pid process target process PID 2604 wrote to memory of 388 2604 360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe MpMgSvc.exe PID 2604 wrote to memory of 388 2604 360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe MpMgSvc.exe PID 2604 wrote to memory of 388 2604 360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe MpMgSvc.exe PID 388 wrote to memory of 6756 388 MpMgSvc.exe Wmicc.exe PID 388 wrote to memory of 6756 388 MpMgSvc.exe Wmicc.exe PID 388 wrote to memory of 6756 388 MpMgSvc.exe Wmicc.exe PID 6756 wrote to memory of 1276 6756 Wmicc.exe cmd.exe PID 6756 wrote to memory of 1276 6756 Wmicc.exe cmd.exe PID 6756 wrote to memory of 1276 6756 Wmicc.exe cmd.exe PID 1276 wrote to memory of 6524 1276 cmd.exe GetPassword.exe PID 1276 wrote to memory of 6524 1276 cmd.exe GetPassword.exe PID 2604 wrote to memory of 3332 2604 360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe Hooks.exe PID 2604 wrote to memory of 3332 2604 360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe Hooks.exe PID 2604 wrote to memory of 3332 2604 360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe Hooks.exe PID 3332 wrote to memory of 6944 3332 Hooks.exe powershell.exe PID 3332 wrote to memory of 6944 3332 Hooks.exe powershell.exe PID 3332 wrote to memory of 6944 3332 Hooks.exe powershell.exe PID 5352 wrote to memory of 3408 5352 svchost.exe svchost.exe PID 5352 wrote to memory of 3408 5352 svchost.exe svchost.exe PID 5352 wrote to memory of 3408 5352 svchost.exe svchost.exe PID 5352 wrote to memory of 3408 5352 svchost.exe svchost.exe PID 5352 wrote to memory of 3408 5352 svchost.exe svchost.exe PID 5352 wrote to memory of 3408 5352 svchost.exe svchost.exe PID 5352 wrote to memory of 3408 5352 svchost.exe svchost.exe PID 5352 wrote to memory of 3408 5352 svchost.exe svchost.exe PID 5352 wrote to memory of 7924 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7924 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7924 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 624 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 624 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 624 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7692 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7692 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7692 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 6176 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 6176 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 6176 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 2736 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 2736 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 2736 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 2212 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 2212 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 2212 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 5904 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 5904 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 5904 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7308 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7308 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7308 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7520 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7520 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7520 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 4508 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 4508 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 4508 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7940 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7940 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7940 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7980 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7980 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 7980 5352 svchost.exe netsh.exe PID 5352 wrote to memory of 4528 5352 svchost.exe ctfmoon.exe PID 5352 wrote to memory of 4528 5352 svchost.exe ctfmoon.exe PID 5352 wrote to memory of 4528 5352 svchost.exe ctfmoon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\360664dbd5bb1fbc4493eee7bea66a97db20f7deabac57cbbeba455226ae5c01_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\Temp\MpMgSvc.exe"C:\WINDOWS\Temp\MpMgSvc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\Wmicc.exe"C:\Windows\Temp\Wmicc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\Temp\GetPassword.exe >C:\Windows\Temp\PWD.txt4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\GetPassword.exeC:\Windows\Temp\GetPassword.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\WINDOWS\Temp\Hooks.exe"C:\WINDOWS\Temp\Hooks.exe"2⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\WINDOWS\Temp\Hooks.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 16282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2604 -ip 26041⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name=Microsoft_Edge dir=in program=C:\Windows\Microsoft.NET\Meson.exe action=allow2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name=Microsoft_Edge dir=out program=C:\Windows\Microsoft.NET\Meson.exe action=allow2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule name=Microsoft_Edge new enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule name=Microsoft_Store new enable=yes2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\Microsoft.NET\ctfmoon.exeC:\Windows\Microsoft.NET\ctfmoon.exe [email protected] -password=123456Aa. -device-name=Win32 -accept-tos2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Meson.exeC:\Windows\Microsoft.NET\Meson.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exeC:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Server Software Component
1Terminal Services DLL
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wu5ulnke.ace.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\Microsoft.NET\Meson.exeFilesize
8.9MB
MD587c8b215c031443d630da6c18088f89a
SHA17a17a9026ec093c4571c13c2fc128b27fbd66a11
SHA2560caedcf61c3bfe2da33b30adf2f5f2c1530b6907f133f4289519a56cc5c1bae6
SHA51248d5565f5da60371b79d2c380a63c7b416a220ae7f52656ba4ed9447cf55ab73a05c4165c61c2a95c4e586b2baf483b0b97dcff77c76cadfe039690ded35c43e
-
C:\Windows\Microsoft.NET\ctfmoon.exeFilesize
9.1MB
MD51de26ef85f7218e1df4ed675fa2b05d4
SHA1e5217fa3b50f625d84d5e5c4b66c031f7a2446ae
SHA256fdd762192d351cea051c0170840f1d8d171f334f06313a17eba97cacb5f1e6e1
SHA512ada80a9f97bec76899eccc40c646387a067a201663d4d0f4537af450ea7c92df877f017862634e32e9e2ba08ca6d41806dc03f0dfd7f811ca303b56b1ac17d92
-
C:\Windows\Microsoft.NET\root_conf\default.tomlFilesize
390B
MD59e3d810a244768218af8fc0499bd5dd7
SHA1660cb236baf95c83e0acd64e3f607fbeb199a1e0
SHA256e864d44ec86eaa38112c3bfcfc21b078cc59e11f984c0441989e8606197357e2
SHA5128f9ac0dede89a68202eb858cda086727ebbba3fdfb4fa43ce2d52cdd5e69c89f66a171fae371ca29b4d65dc04862cbcb71e58be48e8dcc520e1db3b27a093f2b
-
C:\Windows\Microsoft.NET\traffmonetizer\Base.dllFilesize
106KB
MD5c3935313bbf380cd8d3cb336a5e3c8e8
SHA1c09f0b894ee5a6a59dea194e94b42fff29b53f38
SHA2564d0409c6db0b0af97f5fc57ebe2248c1632aeb836a5ea1eeaad64f57a4eb662b
SHA5126525f98811cb277fbae75e278fca7997c6a6993b3f3f163a3c98da85055305d7a61917981625f113c448b8a397d3c5a143db2c8b131e5e4395205e34dc7c48a2
-
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dllFilesize
20KB
MD51ee251645b8a54a116d6d06c83a2bd85
SHA15dbf1534ffbff016cc45559eb5eff3dc4252a522
SHA256075ce79e84041137c78885b3738c1b5a03547d0ae2a79916e844196a9d0ec1db
SHA5129f67fd0566eac2da4253d08697daab427e4e85780615d940f086a88424dcbb0563abae7e4824088e64ef7024c1bb3bbf324f2d07bc7ba55f79e4af3c9ea88e97
-
C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dllFilesize
20KB
MD5ecdfe8ede869d2ccc6bf99981ea96400
SHA12f410a0396bc148ed533ad49b6415fb58dd4d641
SHA256accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
SHA5125fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
-
C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dllFilesize
137KB
MD56fb95a357a3f7e88ade5c1629e2801f8
SHA119bf79600b716523b5317b9a7b68760ae5d55741
SHA2568e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
SHA512293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
-
C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dllFilesize
193KB
MD5665e355cbed5fe5f7bebc3cb23e68649
SHA11c2cefafba48ba7aaab746f660debd34f2f4b14c
SHA256b5d20736f84f335ef4c918a5ba41c3a0d7189397c71b166ccc6c342427a94ece
SHA5125300d39365e84a67010ae4c282d7e05172563119afb84dc1b0610217683c7d110803aef02945034a939262f6a7ecf629b52c0e93c1cd63d52ca7a3b3e607bb7d
-
C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dllFilesize
113KB
MD5aaa2cbf14e06e9d3586d8a4ed455db33
SHA13d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA2561d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
SHA5120b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
-
C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dllFilesize
16KB
MD59a341540899dcc5630886f2d921be78f
SHA1bab44612721c3dc91ac3d9dfca7c961a3a511508
SHA2563cadcb6b8a7335141c7c357a1d77af1ff49b59b872df494f5025580191d1c0d5
SHA512066984c83de975df03eee1c2b5150c6b9b2e852d9caf90cfd956e9f0f7bd5a956b96ea961b26f7cd14c089bc8a27f868b225167020c5eb6318f66e58113efa37
-
C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dllFilesize
66KB
MD5e8cdacfd2ef2f4b3d1a8e6d59b6e3027
SHA19a85d938d8430a73255a65ea002a7709c81a4cf3
SHA256edf13ebf2d45152e26a16b947cd953aeb7a42602fa48e53fd7673934e5acea30
SHA512ee1005270305b614236d68e427263b4b4528ad3842057670fad061867286815577ec7d3ed8176e6683d723f9f592abcbf28d24935ce8a34571ab7f1720e2ffc5
-
C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dllFilesize
347KB
MD538470ca21414a8827c24d8fe0438e84b
SHA11c394a150c5693c69f85403f201caa501594b7ab
SHA2562c7435257690ac95dc03b45a236005124097f08519adf3134b1d1ece4190e64c
SHA512079f7320cc2f3b97a5733725d3b13dff17b595465159daabca5a166d39777100e5a2d9af2a75989dfabdb2f29eac0710e16c3bb2660621344b7a63c5dbb87ef8
-
C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dllFilesize
25KB
MD5e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA12242627282f9e07e37b274ea36fac2d3cd9c9110
SHA2564f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
SHA512da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
-
C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dllFilesize
77KB
MD58c9424e37a28db7d70e7d52f0df33cf8
SHA181cd1acb53d493c54c8d56f379d790a901a355ac
SHA256e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f
SHA512cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4
-
C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exeFilesize
680KB
MD52884fdeaa62f29861ce2645dde0040f6
SHA101a775a431f6e4da49f5c5da2dab74cc4d770021
SHA2562923eacd0c99a2d385f7c989882b7cca83bff133ecf176fdb411f8d17e7ef265
SHA512470ce2cf25d7ee66f4ceb197e218872ea1b865de7029fadb0d41f3324a213b94c668968f20e228e87a879c1f0c13c9827f3b8881820d02e780d567d791ad159f
-
C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe.configFilesize
18KB
MD5e3f86e44d1997122912dd19c93b4cc51
SHA155a2abf767061a27d48fc5eda94ba8156add3e81
SHA2568905f68562e02ca9c686f8bb6edde6643c94b2592240c6ed0d40ca380e69e62d
SHA512314f97d7889d22d1086682c2abfcf0bcb753c2103a29127407392fa05dabb69f1528c7b8028aeac48e5fd7daf0fb1e4a367e6d83f7ca73bcea8e7c6e1d1b54d5
-
C:\Windows\Temp\GetPassword.exeFilesize
494KB
MD55b6a804db0c5733d331eb126048ca73b
SHA1f18c5acae63457ad26565d663467fa5a7fbfbee4
SHA2565bec6b3bc6f8cbda50a8c5195a488cc82d2e00f18ec75640db31b2376a6db9f9
SHA512ba6424051ab9f650967cc2ba428fd6a02ccda8f99d8b8e3f5f321a5e6bbf79a22bfc9cdd582c44980470ebbb7aea1b811fd69aab6bf51466a803c7c722fcde26
-
C:\Windows\Temp\Hooks.exeFilesize
11.7MB
MD5e5aa445a4f523de1b08d0efdd47c1fac
SHA162a5953f5092810669b1fdf1fd0e5918b4527174
SHA2567ca01cb68c03434dd6a45bd79206370dc69b8787825c5d26ec75dcc4a3b14f81
SHA512ba4ccc699827cf66630a0f543cdd35ee8538be5c2c441aa851b5ccd3d29c9500cdbcca917a556ff58c0c6ac2c9943954c1775abb81f9d7d7ddf09a9569308bdc
-
C:\Windows\Temp\MpMgSvc.exeFilesize
3.2MB
MD52311a69113104a760d785a79f45bab74
SHA132e883771883ba44715180e92a20c80638c5c78f
SHA256f2af31b74bfe1648b8c06ce5b3869e81ce8caafe4a265e007af4036af3448ae7
SHA512aafbd53acb886e6ab7706400852e8b79766ae99f5899b45952dc21cc55d91f0dca2d86e25f2568dc2b497a73a9c7e70682f98d8901c8089ac5650e46e1dd87e1
-
C:\Windows\Temp\PWD.txtFilesize
16B
MD5f4ee302afbce0b94cd33c6b3941d19e2
SHA175f98857186248ac2f9cbd0c3f07d1118b49ee10
SHA256dfb23411a6872447e75541e6b3067026d10ebc8f76f427a5f69d795498e117f9
SHA512ca202ca2caf8a1e9596f1187a82cd02a650aea316c9a6bf58c59a23b4922098fe3720301dbe3268514e977a5964dc746f38c862ce4cdc63573d0e69254ea0e77
-
C:\Windows\Temp\Wmicc.exeFilesize
1.0MB
MD5e1f8ee38a7e1f76e636499eb40aec1ca
SHA16d5688ea53b2fe9a3fd751350446f6205d94dba0
SHA256c82e90cf223bf9c1fb77d44d2cd7678d7ad6994363973502633e7f25fdbd2d93
SHA51266ca4dcb5cbf0efbed23b8edf8763bac1b8c1090bb797fb53b00b18d3bf751b4c2e685699f3b08bed393fb0d5183d1a86780291369b817e241e8a0f1224a7ec1
-
C:\Windows\Temp\ip.txtFilesize
180KB
MD5c1dc6337fbe44f654f2da45a760566b8
SHA10312f0508df1e8e531cc133dfb8c7dbb2090e4a7
SHA256149f1a04b974438ec637c6281b8da2145e53034eef2c247797b63c23ee5e6f40
SHA51212a69809cb01e30746dcbf5ce8c156517d78efceaae1c01f288ff6be39af9232f821725129468dd921044599873e2f2152c7a7a662dda4a29e2165b1be77de69
-
C:\Windows\Temp\ip.txtFilesize
2KB
MD53a1b24bf6551c7d55d29fe06f254d66f
SHA1860fe18d0a29484e4cf47adaf9a2793d216c31e0
SHA2567f9e2f61c1c2e35c0b739a22296bc433a36bd717693e074d98a318bf698e638c
SHA512c8726c28e6d1ed47a60abd28192418f6b0a7c0a63fcbc41e40d6265627a45da55a768a6bbe16c905e361a51bb0cae34029c7312a0994abf71fd04357b6fd866f
-
C:\Windows\Temp\ip.txtFilesize
3KB
MD5dd5cb784b872629fb239920bbce14d24
SHA10d915acd267b5901f41b79ca7aa7d98f198da7d9
SHA25648e3d769d0b8adc8c172cc3cd0bafa26d80e72082894ddddb769bfc21e18b897
SHA512e2673f9bf13dd5f6c5aacd3216404cfdae56ddf480d74800ed8f406a75421be53aa9fd371a9bb2b036cfb0031989020f4e234f595172612fefba7f07fd3d4f8e
-
C:\Windows\Temp\ip.txtFilesize
4KB
MD58a2ed77f96063e806244ea0381c207c8
SHA1b3391aeed21abb939f719256a2ca4be933fbcd65
SHA2563f6054ca001f1287fa4bcc7a7f9422caaa4cd1e018969bdc3fb6634fe97d3711
SHA5125e0250a9994521eb032d5f58b89708e4f353a4ce63c6b270135f1dbc560c12216a37d16b8889e1c61a6615e780ba3350180f8d35a721b7370868b14e81ad5633
-
C:\Windows\Temp\ip.txtFilesize
409B
MD58fdd6c822d351b82a4e8ae7fc922cdd4
SHA1ca7c4ff4738a22805b99374924f87664114d75dd
SHA256d54066a541c4f619d29abc95922dcd53dfd29b8d4b04a7d0d87fd0da05c80863
SHA512d1d4c8f1a01c779913eff53095e95a05aae0d290de2882d8dedd8ac57d5d703febff9bcca7f4cdf21999086390c03bfb41875ee6658523515a3331b213edbff7
-
C:\Windows\Temp\ip.txtFilesize
1KB
MD547648ff47239ff978b0b05fc5d3abafe
SHA1ee07d5ef70a537bbb479fa5190d3079ab23b65c1
SHA25615d293f4e8befb6ede130fa989fbae9faba64468e8e7e2e39787d74544f879dc
SHA512eef57a8b5c030c8307a355ab9f302ed6c140a5bda3198f7cb2f11c32408da58b96731edfeea187d1daa1684e5f37bb6fec688bbfe6a33dd737ecce75318021fb
-
C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.jsonFilesize
98B
MD52e839b7ab87694f72220658502588c41
SHA1b3996f638b1e00b4bdf5cadeab99d05492313f37
SHA256376a0ca610d4de58de3887a8700d3e0f64fdc2123846a4f88876751847aef519
SHA512050fe964fbdfd1a957ef3e8a1c1ce6ada6d5473be890ea318a9720a7c8e42e9fb8afcc723a03ed9deeb3f2ccbff0fe725eb0b831a24e9e4df39b7249da5688a1
-
\??\c:\users\admin\appdata\roaming\graphicsperfsvcs.dllFilesize
23.7MB
MD5070c358598e30c4300caef33ec7fdda3
SHA176b1d2b6cd781e1f0bb8cd601ea740d1602fc096
SHA2562dc754845d02d1d9e3757f1b9d0023bede2893e80fdf75d016ebbc008c910ff9
SHA512f8a690bea6ff7a77a844e15e5705698add1cf807fdb0b7f2443cf787b809f3dc94ee744cca4f3b2687c2f138547610db24bff096ddda99240ebca69b1bc8428a
-
memory/388-13576-0x0000000000400000-0x0000000000D0A000-memory.dmpFilesize
9.0MB
-
memory/388-13557-0x0000000000400000-0x0000000000D0A000-memory.dmpFilesize
9.0MB
-
memory/388-13771-0x0000000000400000-0x0000000000D0A000-memory.dmpFilesize
9.0MB
-
memory/388-18-0x0000000000400000-0x0000000000D0A000-memory.dmpFilesize
9.0MB
-
memory/388-45-0x0000000000400000-0x0000000000D0A000-memory.dmpFilesize
9.0MB
-
memory/388-13546-0x0000000000400000-0x0000000000D0A000-memory.dmpFilesize
9.0MB
-
memory/388-13548-0x0000000000400000-0x0000000000D0A000-memory.dmpFilesize
9.0MB
-
memory/388-13740-0x0000000000400000-0x0000000000D0A000-memory.dmpFilesize
9.0MB
-
memory/388-13727-0x0000000000400000-0x0000000000D0A000-memory.dmpFilesize
9.0MB
-
memory/388-13734-0x0000000000400000-0x0000000000D0A000-memory.dmpFilesize
9.0MB
-
memory/3332-13577-0x0000000000400000-0x0000000001BF5000-memory.dmpFilesize
24.0MB
-
memory/3332-13580-0x0000000000400000-0x0000000001BF5000-memory.dmpFilesize
24.0MB
-
memory/3408-13584-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3408-13586-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3408-13583-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3408-13582-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/6240-13761-0x000002165CE30000-0x000002165CE44000-memory.dmpFilesize
80KB
-
memory/6240-13759-0x000002165CD10000-0x000002165CD18000-memory.dmpFilesize
32KB
-
memory/6240-13769-0x000002165F410000-0x000002165F41A000-memory.dmpFilesize
40KB
-
memory/6240-13745-0x0000021643BC0000-0x0000021643C6C000-memory.dmpFilesize
688KB
-
memory/6240-13750-0x000002165CD80000-0x000002165CDDA000-memory.dmpFilesize
360KB
-
memory/6240-13767-0x000002165D150000-0x000002165D15A000-memory.dmpFilesize
40KB
-
memory/6240-13765-0x000002165D000000-0x000002165D032000-memory.dmpFilesize
200KB
-
memory/6240-13753-0x000002165CD30000-0x000002165CD56000-memory.dmpFilesize
152KB
-
memory/6240-13763-0x000002165CF50000-0x000002165CF6E000-memory.dmpFilesize
120KB
-
memory/6240-13755-0x000002165CD00000-0x000002165CD0A000-memory.dmpFilesize
40KB
-
memory/6240-13757-0x000002165CDF0000-0x000002165CE06000-memory.dmpFilesize
88KB
-
memory/6240-13747-0x00000216444C0000-0x00000216444DE000-memory.dmpFilesize
120KB
-
memory/6944-13722-0x0000000007060000-0x00000000070F6000-memory.dmpFilesize
600KB
-
memory/6944-13591-0x00000000057B0000-0x0000000005816000-memory.dmpFilesize
408KB
-
memory/6944-13724-0x0000000008070000-0x0000000008614000-memory.dmpFilesize
5.6MB
-
memory/6944-13602-0x0000000005DF0000-0x0000000005E0E000-memory.dmpFilesize
120KB
-
memory/6944-13590-0x0000000005740000-0x00000000057A6000-memory.dmpFilesize
408KB
-
memory/6944-13723-0x00000000063C0000-0x00000000063E2000-memory.dmpFilesize
136KB
-
memory/6944-13601-0x0000000005920000-0x0000000005C74000-memory.dmpFilesize
3.3MB
-
memory/6944-13589-0x0000000004E40000-0x0000000004E62000-memory.dmpFilesize
136KB
-
memory/6944-13588-0x0000000004F20000-0x0000000005548000-memory.dmpFilesize
6.2MB
-
memory/6944-13604-0x0000000007440000-0x0000000007ABA000-memory.dmpFilesize
6.5MB
-
memory/6944-13605-0x00000000062F0000-0x000000000630A000-memory.dmpFilesize
104KB
-
memory/6944-13587-0x0000000004840000-0x0000000004876000-memory.dmpFilesize
216KB
-
memory/6944-13603-0x0000000005E40000-0x0000000005E8C000-memory.dmpFilesize
304KB