sality | 02c38628556a2e6010ed2365ba9a698f0a9cb9f59b6d90aa9d2a15cc36541790

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02c38628556a2e6010ed2365ba9a698f0a9cb9f59b6d90aa9d2a15cc36541790_NeikiAnalytics.dll
Size

120KB
MD5

1afd427a5a54d4dbd345bfe25d79d0b0
SHA1

95f210c291fb9ee2723d4a8018229047b4c90c69
SHA256

02c38628556a2e6010ed2365ba9a698f0a9cb9f59b6d90aa9d2a15cc36541790
SHA512

a65de0d954b4bd85a0d3aec6e2b79c1885ae66fa4a1acd918aaa35ffa9eee14a94c9e4aba0814bb0cc46fb92e67bebb0ec2aedd8d2eced58659969dc5d469c7f
SSDEEP

3072:Zo7F1o2cxu0MxEe5fhJhW/qtafP4pCO/24S4ABB:c7RcoxEePjEqk82b4A

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

e573f4b.exee5761f6.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e5761f6.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e573f4b.exee5761f6.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5761f6.exe

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e5761f6.exee573f4b.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5761f6.exe

Executes dropped EXE 3 IoCs

Processes:

e573f4b.exee574045.exee5761f6.exe

pid process

2128 e573f4b.exe
2232 e574045.exe
4312 e5761f6.exe

pid	process
2128	e573f4b.exe
2232	e574045.exe
4312	e5761f6.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2128-6-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-33-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-25-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-28-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-34-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-24-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-11-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-10-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-9-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-35-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-36-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-37-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-38-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-39-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-40-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-59-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-60-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-62-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-63-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-65-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-66-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-71-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-77-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-79-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-80-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/2128-84-0x00000000007F0000-0x00000000018AA000-memory.dmp	upx
behavioral2/memory/4312-130-0x0000000000B40000-0x0000000001BFA000-memory.dmp	upx

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e5761f6.exee573f4b.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e573f4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e573f4b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e5761f6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e5761f6.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

e573f4b.exee5761f6.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5761f6.exe

Enumerates connected drives 3 TTPs 11 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e573f4b.exe

description	ioc	process
File opened (read-only)	\??\K:	e573f4b.exe
File opened (read-only)	\??\O:	e573f4b.exe
File opened (read-only)	\??\P:	e573f4b.exe
File opened (read-only)	\??\L:	e573f4b.exe
File opened (read-only)	\??\M:	e573f4b.exe
File opened (read-only)	\??\N:	e573f4b.exe
File opened (read-only)	\??\E:	e573f4b.exe
File opened (read-only)	\??\G:	e573f4b.exe
File opened (read-only)	\??\H:	e573f4b.exe
File opened (read-only)	\??\I:	e573f4b.exe
File opened (read-only)	\??\J:	e573f4b.exe

Drops file in Program Files directory 3 IoCs

Processes:

e573f4b.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e573f4b.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e573f4b.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e573f4b.exe

Drops file in Windows directory 3 IoCs

Processes:

e573f4b.exee5761f6.exe

description ioc process

File created C:\Windows\e573f89 e573f4b.exe
File opened for modification C:\Windows\SYSTEM.INI e573f4b.exe
File created C:\Windows\e57b074 e5761f6.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e573f4b.exe

pid process

2128 e573f4b.exe
2128 e573f4b.exe
2128 e573f4b.exe
2128 e573f4b.exe

description	ioc	process
File created	C:\Windows\e573f89	e573f4b.exe
File opened for modification	C:\Windows\SYSTEM.INI	e573f4b.exe
File created	C:\Windows\e57b074	e5761f6.exe

pid	process
2128	e573f4b.exe
2128	e573f4b.exe
2128	e573f4b.exe
2128	e573f4b.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e573f4b.exe

description	pid	process
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe
Token: SeDebugPrivilege	2128	e573f4b.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

rundll32.exerundll32.exee573f4b.exe

description	pid	process	target process
PID 3460 wrote to memory of 384	3460	rundll32.exe	rundll32.exe
PID 3460 wrote to memory of 384	3460	rundll32.exe	rundll32.exe
PID 3460 wrote to memory of 384	3460	rundll32.exe	rundll32.exe
PID 384 wrote to memory of 2128	384	rundll32.exe	e573f4b.exe
PID 384 wrote to memory of 2128	384	rundll32.exe	e573f4b.exe
PID 384 wrote to memory of 2128	384	rundll32.exe	e573f4b.exe
PID 2128 wrote to memory of 764	2128	e573f4b.exe	fontdrvhost.exe
PID 2128 wrote to memory of 768	2128	e573f4b.exe	fontdrvhost.exe
PID 2128 wrote to memory of 1012	2128	e573f4b.exe	dwm.exe
PID 2128 wrote to memory of 2476	2128	e573f4b.exe	svchost.exe
PID 2128 wrote to memory of 2484	2128	e573f4b.exe	sihost.exe
PID 2128 wrote to memory of 2848	2128	e573f4b.exe	taskhostw.exe
PID 2128 wrote to memory of 3440	2128	e573f4b.exe	Explorer.EXE
PID 2128 wrote to memory of 3656	2128	e573f4b.exe	svchost.exe
PID 2128 wrote to memory of 3840	2128	e573f4b.exe	DllHost.exe
PID 2128 wrote to memory of 3936	2128	e573f4b.exe	StartMenuExperienceHost.exe
PID 2128 wrote to memory of 4004	2128	e573f4b.exe	RuntimeBroker.exe
PID 2128 wrote to memory of 1004	2128	e573f4b.exe	SearchApp.exe
PID 2128 wrote to memory of 2976	2128	e573f4b.exe	RuntimeBroker.exe
PID 2128 wrote to memory of 1192	2128	e573f4b.exe	TextInputHost.exe
PID 2128 wrote to memory of 4116	2128	e573f4b.exe	RuntimeBroker.exe
PID 2128 wrote to memory of 656	2128	e573f4b.exe	backgroundTaskHost.exe
PID 2128 wrote to memory of 3292	2128	e573f4b.exe	backgroundTaskHost.exe
PID 2128 wrote to memory of 3460	2128	e573f4b.exe	rundll32.exe
PID 2128 wrote to memory of 384	2128	e573f4b.exe	rundll32.exe
PID 2128 wrote to memory of 384	2128	e573f4b.exe	rundll32.exe
PID 384 wrote to memory of 2232	384	rundll32.exe	e574045.exe
PID 384 wrote to memory of 2232	384	rundll32.exe	e574045.exe
PID 384 wrote to memory of 2232	384	rundll32.exe	e574045.exe
PID 384 wrote to memory of 4312	384	rundll32.exe	e5761f6.exe
PID 384 wrote to memory of 4312	384	rundll32.exe	e5761f6.exe
PID 384 wrote to memory of 4312	384	rundll32.exe	e5761f6.exe
PID 2128 wrote to memory of 764	2128	e573f4b.exe	fontdrvhost.exe
PID 2128 wrote to memory of 768	2128	e573f4b.exe	fontdrvhost.exe
PID 2128 wrote to memory of 1012	2128	e573f4b.exe	dwm.exe
PID 2128 wrote to memory of 2476	2128	e573f4b.exe	svchost.exe
PID 2128 wrote to memory of 2484	2128	e573f4b.exe	sihost.exe
PID 2128 wrote to memory of 2848	2128	e573f4b.exe	taskhostw.exe
PID 2128 wrote to memory of 3440	2128	e573f4b.exe	Explorer.EXE
PID 2128 wrote to memory of 3656	2128	e573f4b.exe	svchost.exe
PID 2128 wrote to memory of 3840	2128	e573f4b.exe	DllHost.exe
PID 2128 wrote to memory of 3936	2128	e573f4b.exe	StartMenuExperienceHost.exe
PID 2128 wrote to memory of 4004	2128	e573f4b.exe	RuntimeBroker.exe
PID 2128 wrote to memory of 1004	2128	e573f4b.exe	SearchApp.exe
PID 2128 wrote to memory of 2976	2128	e573f4b.exe	RuntimeBroker.exe
PID 2128 wrote to memory of 1192	2128	e573f4b.exe	TextInputHost.exe
PID 2128 wrote to memory of 4116	2128	e573f4b.exe	RuntimeBroker.exe
PID 2128 wrote to memory of 656	2128	e573f4b.exe	backgroundTaskHost.exe
PID 2128 wrote to memory of 3292	2128	e573f4b.exe	backgroundTaskHost.exe
PID 2128 wrote to memory of 2232	2128	e573f4b.exe	e574045.exe
PID 2128 wrote to memory of 2232	2128	e573f4b.exe	e574045.exe
PID 2128 wrote to memory of 1588	2128	e573f4b.exe	RuntimeBroker.exe
PID 2128 wrote to memory of 3020	2128	e573f4b.exe	RuntimeBroker.exe
PID 2128 wrote to memory of 4312	2128	e573f4b.exe	e5761f6.exe
PID 2128 wrote to memory of 4312	2128	e573f4b.exe	e5761f6.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

e573f4b.exee5761f6.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e573f4b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e5761f6.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:764

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:768

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2476

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2484

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2848

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3440

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02c38628556a2e6010ed2365ba9a698f0a9cb9f59b6d90aa9d2a15cc36541790_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:3460

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\02c38628556a2e6010ed2365ba9a698f0a9cb9f59b6d90aa9d2a15cc36541790_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Users\Admin\AppData\Local\Temp\e573f4b.exe
C:\Users\Admin\AppData\Local\Temp\e573f4b.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2128

C:\Users\Admin\AppData\Local\Temp\e574045.exe
C:\Users\Admin\AppData\Local\Temp\e574045.exe
4⤵
- Executes dropped EXE
PID:2232

C:\Users\Admin\AppData\Local\Temp\e5761f6.exe
C:\Users\Admin\AppData\Local\Temp\e5761f6.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3656

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3840

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3936

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4004

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1004

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2976

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1192

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4116

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:656

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3292

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3020

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e573f4b.exe
Filesize
97KB

MD5
eddbdfaebd7b5206abe8a53d9ca7ca0f

SHA1
0a41fea4aafbc7be6fd63a763e7e5468887bf9ea

SHA256
6cf7d1ee1724eaa76884f13555207ce484f81d879c35ca55a218318e7495e548

SHA512
99a6ea5092ff41489386467f2aae9b796cf53d4a126d5dda6e74d11445de62a032ac814e0269f000e25a9ed37c2931a32af452735dc6c0d5bbbb44b5c9b6d9eb

Download Submit
C:\Windows\SYSTEM.INI
Filesize
257B

MD5
688cc02034bdc277f4eb2efc46214447

SHA1
3372c967ed70b3496c076ddd195779ca56047397

SHA256
1ab04935847dbe385450465b7bd83728a58ecb78a68b946fa0f67eaf78d5f8c5

SHA512
0fed7aa8b183743e58bbf9d880910fb8a40acd39779bd0db31a3a4bebb873ec3cf23398ffbeb2063c346f926943666424e34d679d5e20cd8aa8c3764160a64ba

Download Submit
memory/384-32-0x0000000000710000-0x0000000000712000-memory.dmp

Filesize
8KB

Download
memory/384-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/384-16-0x0000000000710000-0x0000000000712000-memory.dmp

Filesize
8KB

Download
memory/384-12-0x0000000000710000-0x0000000000712000-memory.dmp

Filesize
8KB

Download
memory/384-13-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/2128-39-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-66-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-34-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-26-0x0000000001B30000-0x0000000001B32000-memory.dmp

Filesize
8KB

Download
memory/2128-24-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-11-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-25-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2128-15-0x0000000001B40000-0x0000000001B41000-memory.dmp

Filesize
4KB

Download
memory/2128-33-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-30-0x0000000001B30000-0x0000000001B32000-memory.dmp

Filesize
8KB

Download
memory/2128-10-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-9-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-35-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-36-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-37-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-38-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-6-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-40-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-101-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2128-84-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-92-0x0000000001B30000-0x0000000001B32000-memory.dmp

Filesize
8KB

Download
memory/2128-80-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-79-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-77-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-71-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-59-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-60-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-62-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-63-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-65-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2128-28-0x00000000007F0000-0x00000000018AA000-memory.dmp

Filesize
16.7MB

Download
memory/2232-57-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2232-53-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2232-52-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/2232-105-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2232-31-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4312-58-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4312-55-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4312-56-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/4312-49-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4312-129-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4312-130-0x0000000000B40000-0x0000000001BFA000-memory.dmp

Filesize
16.7MB

Download
memory/4312-131-0x0000000000B40000-0x0000000001BFA000-memory.dmp

Filesize
16.7MB

Download