7c68e6466b11eaf49109e1dfa6981ccba66f1d1989f390bea75a3362018e0b63

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Size 91KB
Sample240513-jf2fdscf5x
SHA256 7c68e6466b11eaf49109e1dfa6981ccba66f1d1989f390bea75a3362018e0b63
MD5 a6763e8cf4bf98a3bc251bb8776d4350
SHA1 33fc382c77ba7f7b374a516dfb4d884a4266ec58
SHA512 70d5896e2d996a29e69a3531967b212231dc9899e27c5ac99edf916135e7d9a6a06db4455631fed37f0cebfd6369571cdd1b61206c52e2f58cefafe5cc3e816e
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imu33gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS48T3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\""	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 14 IoCs

pid	Process
2252	xk.exe
2912	IExplorer.exe
2712	WINLOGON.EXE
2696	CSRSS.EXE
2780	SERVICES.EXE
1568	LSASS.EXE
1240	SMSS.EXE
2088	xk.exe
1664	IExplorer.exe
1956	WINLOGON.EXE
1928	CSRSS.EXE
1404	SERVICES.EXE
1656	LSASS.EXE
1756	SMSS.EXE

Loads dropped DLL 24 IoCs

pid	Process
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Modifies system executable filetype association 2 TTPs 13 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\desktop.ini	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File created	C:\desktop.ini	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened for modification	F:\desktop.ini	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File created	F:\desktop.ini	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\V:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\X:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\I:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\J:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\R:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\T:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\U:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\H:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\K:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\O:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\P:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\W:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\Z:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\E:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\L:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\M:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\S:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\B:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened (read-only)	\??\G:	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mig2.scr	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\shell.exe	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\shell.exe	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xk.exe	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File created	C:\Windows\xk.exe	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	OUTLOOK.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E5-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E4-0000-0000-C000-000000000046}\ = "OlkListBoxEvents"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300E-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FF-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F8-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063045-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063005-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CD-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D9-0000-0000-C000-000000000046}\ = "_RuleCondition"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FB-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E5-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F6-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F4-0000-0000-C000-000000000046}\ = "_OlkCategory"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063102-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CA-0000-0000-C000-000000000046}\ = "_ExchangeDistributionList"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300A-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063080-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A2-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063089-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DC-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F6-0000-0000-C000-000000000046}\ = "_OlkInfoBar"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063040-0000-0000-C000-000000000046}\ = "_Folders"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C7-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D6-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DE-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006305B-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303E-0000-0000-C000-000000000046}\ = "Actions"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063009-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302C-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EB-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063107-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DE-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063005-0000-0000-C000-000000000046}\ = "_Inspector"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063079-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307B-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A1-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063097-0000-0000-C000-000000000046}\ = "_IconView"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630ED-0000-0000-C000-000000000046}\ = "_JournalModule"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F9-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063005-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C2-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300F-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304D-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006308C-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300E-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063038-0000-0000-C000-000000000046}\ = "_TaskRequestAcceptItem"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672E1-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F4-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063048-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063107-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D5-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307D-0000-0000-C000-000000000046}\ = "InspectorEvents"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EF-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063026-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E4-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E2-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300C-0000-0000-C000-000000000046}\ = "_Results"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300C-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063071-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063096-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063096-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304D-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2716	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	OUTLOOK.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2716	OUTLOOK.EXE
2716	OUTLOOK.EXE
2716	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2716	OUTLOOK.EXE
2716	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
2252	xk.exe
2912	IExplorer.exe
2712	WINLOGON.EXE
2696	CSRSS.EXE
2780	SERVICES.EXE
1568	LSASS.EXE
1240	SMSS.EXE
2088	xk.exe
1664	IExplorer.exe
1956	WINLOGON.EXE
1928	CSRSS.EXE
1404	SERVICES.EXE
1656	LSASS.EXE
1756	SMSS.EXE
2716	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2252	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	28
PID 1704 wrote to memory of 2252	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	28
PID 1704 wrote to memory of 2252	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	28
PID 1704 wrote to memory of 2252	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	28
PID 1704 wrote to memory of 2912	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	29
PID 1704 wrote to memory of 2912	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	29
PID 1704 wrote to memory of 2912	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	29
PID 1704 wrote to memory of 2912	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	29
PID 1704 wrote to memory of 2712	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2712	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2712	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2712	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 2696	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2696	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2696	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2696	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2780	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	32
PID 1704 wrote to memory of 2780	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	32
PID 1704 wrote to memory of 2780	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	32
PID 1704 wrote to memory of 2780	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	32
PID 1704 wrote to memory of 1568	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	33
PID 1704 wrote to memory of 1568	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	33
PID 1704 wrote to memory of 1568	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	33
PID 1704 wrote to memory of 1568	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	33
PID 1704 wrote to memory of 1240	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	34
PID 1704 wrote to memory of 1240	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	34
PID 1704 wrote to memory of 1240	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	34
PID 1704 wrote to memory of 1240	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	34
PID 1704 wrote to memory of 2088	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	35
PID 1704 wrote to memory of 2088	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	35
PID 1704 wrote to memory of 2088	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	35
PID 1704 wrote to memory of 2088	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	35
PID 1704 wrote to memory of 1664	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	36
PID 1704 wrote to memory of 1664	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	36
PID 1704 wrote to memory of 1664	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	36
PID 1704 wrote to memory of 1664	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	36
PID 1704 wrote to memory of 1956	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	37
PID 1704 wrote to memory of 1956	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	37
PID 1704 wrote to memory of 1956	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	37
PID 1704 wrote to memory of 1956	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	37
PID 1704 wrote to memory of 1928	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	38
PID 1704 wrote to memory of 1928	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	38
PID 1704 wrote to memory of 1928	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	38
PID 1704 wrote to memory of 1928	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	38
PID 1704 wrote to memory of 1404	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	39
PID 1704 wrote to memory of 1404	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	39
PID 1704 wrote to memory of 1404	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	39
PID 1704 wrote to memory of 1404	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	39
PID 1704 wrote to memory of 1656	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	40
PID 1704 wrote to memory of 1656	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	40
PID 1704 wrote to memory of 1656	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	40
PID 1704 wrote to memory of 1656	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	40
PID 1704 wrote to memory of 1756	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	41
PID 1704 wrote to memory of 1756	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	41
PID 1704 wrote to memory of 1756	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	41
PID 1704 wrote to memory of 1756	1704	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe	41

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a6763e8cf4bf98a3bc251bb8776d4350_NeikiAnalytics.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1704
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2252
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2912
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2712
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2696
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2780
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1568
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1240
- C:\Windows\xk.exe
  C:\Windows\xk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2088
- C:\Windows\SysWOW64\IExplorer.exe
  C:\Windows\system32\IExplorer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1664
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1956
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1928
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1404
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1656
- C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1756

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

FRMCACHE.DAT

Path C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT
Size 240KB
SHA256 a8cb8458141ed5222827403ac74ad20b5c0279be89d9e1608dea04450254fcf3
MD5 d9bdba0f46b0686222c61bb289d8a59d
SHA1 eb38a541dea0d5067c4064eaee7ed08bc7284940
SHA512 d59c1a92aabcbf0e0fdf50f3000e2c4afd58d340f6074e0e7b80411db230a00235d4e66569722c68f8f2f54762ea02e983ec81804f12d47c56d7a56274cc3775
SSDEEP 3072:0bxgeYZgamiGu2KqoQKrt0Fvd/d+6j+lBzr:QIJmi23Bd+6j+X3
MD5 SHA1 SHA512 SSDEEP

Submit Download

mapisvc.inf

Path C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf
Size 1KB
SHA256 7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a
MD5 48dd6cae43ce26b992c35799fcd76898
SHA1 8e600544df0250da7d634599ce6ee50da11c0355
SHA512 c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Users\Admin\AppData\Local\services.exe
Size 91KB
SHA256 7c68e6466b11eaf49109e1dfa6981ccba66f1d1989f390bea75a3362018e0b63
MD5 a6763e8cf4bf98a3bc251bb8776d4350
SHA1 33fc382c77ba7f7b374a516dfb4d884a4266ec58
SHA512 70d5896e2d996a29e69a3531967b212231dc9899e27c5ac99edf916135e7d9a6a06db4455631fed37f0cebfd6369571cdd1b61206c52e2f58cefafe5cc3e816e
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imu33gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS48T3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 946d188f4046dca5681b8c7d35430d12e5cbe886b497b5199180eb12e33fdb35
MD5 02b035767ea3ad8faadc90f808128abe
SHA1 94ea9a6f225368cb4a0c0caa62d18840cb01f4aa
SHA512 5b1f193019caec01e1abcc744f1cfb0e816fd0e8e703d7c41b0b71b3d1dc9c635bc3be58542b08b6b90ae37e08b2ef92c17a36bfb82b894fbb6709db7d5e6aeb
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imuy3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS45T3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

xk.exe

Path C:\Windows\xk.exe
Size 91KB
SHA256 83fbbb04f16ca2c08f8ceb57221bbd954f1a032f44cbf4bebb395324c34f825b
MD5 dea64616fa4acf335aecbc03402b2b4d
SHA1 d84517a1d90c19652a318100079e35ab10eb530a
SHA512 414a437cf272cefc964b52031b8fd0e189dae21a9d0152bb93b43a8e061b9c58bc687169eb8566f0d7d72acb8ead7541535f46d26058d5d764d56b65e3042258
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuMP33gRYjXbUeHORIC3:uT3OA3+KQsxfS4DPBT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSRSS.EXE

Path \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 e177a1171ba2a62be8e299845a7e2ed0e8320d16bb2ded6f83b9535163097fb4
MD5 dc29acad502ec359fdefcf276bd42a4e
SHA1 3b255743f5889fc95c983e6f8a78a6bbb3498daf
SHA512 d1d7a1aab3dbaaf8bb259c689d978aeffe2d4208c0e821a8d42b84c1d2655ed15db537295d92766247d5af039a3c663f4872d133c7bc4ecbe96153cf159a0c98
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imurm3gRYjXbUeHORIC40:uT3OA3+KQsxfS4pT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSRSS.EXE

Path \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
Size 91KB
SHA256 da1b89af5b8dff5374ef889d04c442b005207aaaca7f4dd20e32c054df139993
MD5 3a77d5e2513d992753ef88f71e92d7fa
SHA1 38f267839f9299eaee6a2e90c372ac8661620a24
SHA512 0d685ccc2264082597ae65541bfde6bc76aefade8c8482962b2a7e341f4ec701ce04cbae692bcd82cd2668db1f9cd1fc3f991e98eed552b84f4d6c2ddd54f409
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuV3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4ST3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 7b92daae49e73fc23837e4a40a229dc6e1b3bc5f9b38ac35addbd2dcf3f86b3a
MD5 e9d6c6287c59e0f1518e4126bd4c3e63
SHA1 ff21b1c5e77c0dad7013d5dd35472d585d3653d0
SHA512 4d9b2420dbd0c028a925a2df37d25f4a8bc3a02b8ef39717aa3df3d30677bd6ddc8c55d17a91a1d98c4ebc63dde6852a25c596ff7b5043d626980e8901b61d3e
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuM3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4/T3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

LSASS.EXE

Path \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
Size 91KB
SHA256 922585baf31c676363b15c1fcc2d709d1b3e68f6ca26efa3ffcea456c57a31da
MD5 d1ed19c1f6d53fcd372d6e87c7f2af67
SHA1 afc0fe1166229d74363f69e341f86d8f2a009b39
SHA512 e4f14d851e54aef6d96923a4a814824a37897f6f2e42b861d3ce8c64a69330da924333b3e0c02302b800af9a49e18fac095555c5b633d5aebb312b3fed21cd80
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imu9a3gRYjXbUeHORIC40:uT3OA3+KQsxfS43T3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 4ffd005688acd382cbcea3687b52d263995e0623006c70ae10deda52ae097b66
MD5 f991f3c60f9a97dbba233474a2254c8a
SHA1 e14de1653566e8facf7d78ae0a7a2744f0c90bbc
SHA512 d92d7756480f1c92966d82b842aac5e91d16dfb187924a4efb814ea7d6622a655f52c0d247bb8fc05a450d1d49d009c64528e3debc5612d15e5dbed88617fc89
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuI3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4XT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

SERVICES.EXE

Path \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
Size 91KB
SHA256 d4cb4aa87de1e452e35ec80e4d99303849432a09b85f0b7b5332a0552fca25a7
MD5 26e4c6f3780ab671179c0a40da08dff4
SHA1 471ac9c2ed71a64b401d41239cd1f05c9e7498ce
SHA512 1f0ea353ec74208664893976d79f7cd7944f6b2a3783b7ea21d1c63371959567f4f94358efcc0cf00da0fd78c127769772ed531064fe6d7f4d7fa7215f3df89e
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imux2Q3gRYjXbUeHORIC3:uT3OA3+KQsxfS4RCT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 0b4248bc5e77607771826f80fa1e75f1cfea049d599eb2f6e12dbcbb2e0d576a
MD5 58c14d03c2a6fadd85ca461a7c68eed2
SHA1 0938e9356e8d85cf0919f79fbc2fc468dc6f751a
SHA512 459a62bb457084ef4b4e34ee0a5b0df98575c5113b36b163ad832527ec67bcd284ed149218ceec7d5d48e6a22e4bb70e9a37772d16dbe48e77443eb56b8dc431
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuS3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4VT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

SMSS.EXE

Path \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
Size 91KB
SHA256 b0b6a3be0c23ae31e5d8400e4569efb7dbadad6f175403f673f235696673ce5d
MD5 4c206591e2aa11fb3862078aeabd50d3
SHA1 d47f9f7b3926f4de428f4b342137f41021992f38
SHA512 5ee74bbb9a2d21538f768d28f40132b2ac3602c73d81118e8ba53082daa509fbb67943a9cb7d41b4324f8e694f98ca6c6ed5a25f7961a23a8ea7fe070ac64377
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuP3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4wT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 adb0ca680e37d8f5574835a7f0ae2cc50e63dbf45405b9f270387740e7a1fe1d
MD5 fd74578f24761ee9438344c682dbc493
SHA1 2156defed992c73565afb4d67de12650cbf95230
SHA512 5adf3454db425e845f40f4992d1df6e7f53aa1deb2c86ba5b688c3a8dd856e2759d23d92703056795191958a29dd3c1a6c65363f20cc83d5a85ed7577443c491
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuJJ3gRYjXbUeHORIC40:uT3OA3+KQsxfS4wT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

WINLOGON.EXE

Path \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
Size 91KB
SHA256 d8b78da0b5473c29572e219a3488fcb0ee9dedcab3acb80545795798a5e2ba8e
MD5 956a0023148c7dfb4afe7bcdeefc24df
SHA1 0cf74a94acc5a17d3001d6be678303bfe2233af7
SHA512 e81f5240ef52db2f9cd2dcbf83cbae98ffca5e9838e297706f3f0f2a4d4acfcf3c53f4f49a0e5fe6dc1f8704ba583dc858d99a2f3abbf5a2e09c7a7521489bca
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imuanb3gRYjXbUeHORIC3:uT3OA3+KQsxfS4PndT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path \Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 eb147275c285fb73a0c0833706d257ab903fcecdeeab61501359d2b67663635a
MD5 c8c9301eef2e5fb6afc6a17ce49af8df
SHA1 b48efc9aebc10bb1bd9435f87dfe754a1a5b3095
SHA512 4f336751f613ab23bdf4a63f857f86bfa7cbb9d1df7f551d942faa278bbfca2cd5bb2ce98d0b286136aff0e9ba5dfdc91ca86193c545a3c37ab61a23245976e4
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3Imu+N3gRYjXbUeHORIC40:uT3OA3+KQsxfS4TT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

IExplorer.exe

Path \Windows\SysWOW64\IExplorer.exe
Size 91KB
SHA256 51d28ed886b7a9ed934d8c7bf5a56322503754243e3df6a4b38c2504e1536f2c
MD5 0b8f02aa305358101d68bebf4909cc1a
SHA1 aabc2b569eff1dca7f52f7032eb7cb666df34ca9
SHA512 15df395a2d6893db4de39109e2f0c9b04bb1aff795d9a81aaaf9f4ef8f44d1f377500416ccac4d9080453dd134579e5f86356d65f82b7379016c1df67597eea8
SSDEEP 768:E3gRYjXbUeHORIC4ZxBMldNKm8Mxm8I+IxrjPfAQ4o3ImuQ3gRYjXbUeHORIC4Z6:uT3OA3+KQsxfS4DT3OA3+KQsxfS4u
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1240-203-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/1240-224-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1404-327-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1404-322-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/1568-190-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/1568-195-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1656-340-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1656-335-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/1664-293-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1664-280-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/1704-290-0x00000000003D0000-0x00000000003FC000-memory.dmp

Download

memory/1704-150-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/1704-112-0x00000000003D0000-0x00000000003FC000-memory.dmp

Download

memory/1704-291-0x00000000003D0000-0x00000000003FC000-memory.dmp

Download

memory/1704-146-0x0000000000020000-0x0000000000024000-memory.dmp

Download

memory/1704-130-0x00000000003D0000-0x00000000003FC000-memory.dmp

Download

memory/1704-123-0x00000000003D0000-0x00000000003FC000-memory.dmp

Download

memory/1704-3-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1704-2-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/1704-113-0x00000000003D0000-0x00000000003FC000-memory.dmp

Download

memory/1704-503-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1704-4-0x0000000000401000-0x0000000000427000-memory.dmp

Download

memory/1704-266-0x00000000003D0000-0x00000000003FC000-memory.dmp

Download

memory/1704-265-0x00000000003D0000-0x00000000003FC000-memory.dmp

Download

memory/1704-1-0x0000000000020000-0x0000000000024000-memory.dmp

Download

memory/1704-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1756-348-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/1756-353-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1928-308-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1928-309-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/1928-316-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1956-295-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/1956-302-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2088-267-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2088-273-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2252-121-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2252-115-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2252-119-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2696-170-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2696-166-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2696-162-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2712-154-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2712-147-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2712-151-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2716-378-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/2780-180-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2780-176-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2780-182-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2912-132-0x0000000072940000-0x0000000072A93000-memory.dmp

Download

memory/2912-131-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2912-136-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2912-138-0x0000000000400000-0x000000000042C000-memory.dmp

Download