Malware Analysis Report

2024-11-15 05:49

Sample ID 240514-gm4g8add65
Target 8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics
SHA256 e4c8b1c4527c76289bb4247f0a02d3dd85545bdc59530f005941455d05826aed
Tags
rat dcrat evasion execution infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e4c8b1c4527c76289bb4247f0a02d3dd85545bdc59530f005941455d05826aed

Threat Level: Known bad

The file 8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

rat dcrat evasion execution infostealer persistence trojan

DcRat

Process spawned unexpected child process

Modifies WinLogon for persistence

UAC bypass

Dcrat family

DCRat payload

DCRat payload

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Checks whether UAC is enabled

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Uses Task Scheduler COM API

System policy modification

Suspicious use of WriteProcessMemory

Modifies system certificate store

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-14 05:56

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-14 05:56

Reported

2024-05-14 05:58

Platform

win7-20240508-en

Max time kernel

120s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\wininit.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\wininit.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\csrss.exe\", \"C:\\Users\\Admin\\NetHood\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\smss.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\wininit.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\wininit.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\csrss.exe\", \"C:\\Users\\Admin\\NetHood\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\winlogon.exe\", \"C:\\Program Files (x86)\\Windows Defender\\en-US\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\wininit.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\csrss.exe\", \"C:\\Users\\Admin\\NetHood\\wininit.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\wininit.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\csrss.exe\", \"C:\\Users\\Admin\\NetHood\\wininit.exe\", \"C:\\MSOCache\\All Users\\explorer.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\winlogon.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\", \"C:\\Users\\Default\\Favorites\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\", \"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\", \"C:\\Users\\Public\\services.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\", \"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\smss.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\wininit.exe\", \"C:\\Users\\Public\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\wininit.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\explorer.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Admin\\NetHood\\wininit.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\Downloads\\smss.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\smss.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\MSOCache\\All Users\\explorer.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default\\Favorites\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Default\\Favorites\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Defender\\fr-FR\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Public\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\spoolsv.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\Admin\\NetHood\\wininit.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Defender\\en-US\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\wininit.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\MSOCache\\All Users\\{90140000-00BA-0409-0000-0000000FF1CE}-C\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\smss.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Adobe\\Acrobat\\9.0\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Defender\\en-US\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\resources\\dwm.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\lsm.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\winlogon.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\explorer.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\96702242-0d98-11ef-bfa8-5aba25856535\\winlogon.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\Downloads\\smss.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Users\\Public\\services.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Defender\fr-FR\services.exe C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Defender\fr-FR\c5b4cb5e9653cc C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Defender\en-US\services.exe C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\RCX25EE.tmp C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\dwm.exe C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\fr-FR\services.exe C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\en-US\RCX3FDF.tmp C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\6cb0b6c459d5d3 C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Defender\en-US\c5b4cb5e9653cc C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\fr-FR\RCX27F2.tmp C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\en-US\services.exe C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\dwm.exe C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
N/A N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2392 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2392 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2392 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2392 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2200 wrote to memory of 2204 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2200 wrote to memory of 2204 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2200 wrote to memory of 2204 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2200 wrote to memory of 900 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows Defender\en-US\services.exe
PID 2200 wrote to memory of 900 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows Defender\en-US\services.exe
PID 2200 wrote to memory of 900 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows Defender\en-US\services.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files (x86)\Windows Defender\en-US\services.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Downloads\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Downloads\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Favorites\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Favorites\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Favorites\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Users\Public\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Public\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Public\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Users\Public\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Adobe\Acrobat\9.0\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\NetHood\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\NetHood\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Recovery\96702242-0d98-11ef-bfa8-5aba25856535\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Defender\en-US\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\en-US\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Defender\en-US\services.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1gqmGK9flh.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\Windows Defender\en-US\services.exe

"C:\Program Files (x86)\Windows Defender\en-US\services.exe"

Network

Country Destination Domain Proto
RU 94.250.255.250:80 94.250.255.250 tcp
RU 94.250.255.250:443 tcp
RU 94.250.255.250:443 tcp

Files

memory/2392-0-0x000007FEF6193000-0x000007FEF6194000-memory.dmp

memory/2392-1-0x0000000000190000-0x0000000000450000-memory.dmp

memory/2392-2-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

memory/2392-3-0x0000000000500000-0x0000000000508000-memory.dmp

memory/2392-4-0x0000000000590000-0x00000000005AC000-memory.dmp

memory/2392-5-0x00000000005B0000-0x00000000005B8000-memory.dmp

memory/2392-6-0x0000000000640000-0x0000000000650000-memory.dmp

memory/2392-7-0x0000000000940000-0x0000000000956000-memory.dmp

memory/2392-8-0x0000000000650000-0x0000000000658000-memory.dmp

memory/2392-9-0x0000000000960000-0x0000000000968000-memory.dmp

memory/2392-10-0x0000000000980000-0x0000000000990000-memory.dmp

memory/2392-11-0x0000000000970000-0x000000000097A000-memory.dmp

memory/2392-12-0x00000000022F0000-0x0000000002346000-memory.dmp

memory/2392-13-0x0000000000990000-0x0000000000998000-memory.dmp

memory/2392-14-0x00000000009B0000-0x00000000009B8000-memory.dmp

memory/2392-15-0x00000000009A0000-0x00000000009AC000-memory.dmp

memory/2392-16-0x0000000002340000-0x0000000002348000-memory.dmp

memory/2392-17-0x0000000002350000-0x000000000235C000-memory.dmp

memory/2392-18-0x0000000002360000-0x000000000236C000-memory.dmp

memory/2392-19-0x0000000002370000-0x0000000002378000-memory.dmp

memory/2392-20-0x0000000002380000-0x0000000002388000-memory.dmp

memory/2392-21-0x0000000002390000-0x000000000239C000-memory.dmp

memory/2392-22-0x0000000002460000-0x000000000246C000-memory.dmp

memory/2392-24-0x0000000002480000-0x000000000248A000-memory.dmp

memory/2392-23-0x0000000002470000-0x0000000002478000-memory.dmp

memory/2392-25-0x0000000002490000-0x000000000249C000-memory.dmp

memory/2392-26-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

C:\Users\Default\Favorites\services.exe

MD5 8cdae0ef9f7f5ab79ec5671644e1a0f0
SHA1 dfae9279327bb5658e9d95daae768bfaf4dca42f
SHA256 e4c8b1c4527c76289bb4247f0a02d3dd85545bdc59530f005941455d05826aed
SHA512 828146a24cc9ddac7e6e4f80df37356cbaf1bf93be1540b9cc3c5e49c7a46ef49f74ef48ba23998b5c388575aa792cc3f43043aadb15ff5b21eff841f49171f6

C:\Program Files (x86)\Windows Defender\fr-FR\RCX27F2.tmp

MD5 a41f32a91dbcdbce4c228699132b93c9
SHA1 d0bd341cffc773cb21f11867dda877229184e183
SHA256 35c3938824834811cd233f1ea6984bb924073e3ea764dfacd7470fd9ba0deedf
SHA512 01d37451651c142fd97895a58e692ca2c730d3bc7bc81fd32e6c0d5ba9f00742f9383d5ca6694e645a99d8e95502db5f783ed3c83b4a334663c287648b9d44b9

memory/2392-190-0x000007FEF6190000-0x000007FEF6B7C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1gqmGK9flh.bat

MD5 fc1767123a892d7ae259539f02430ce7
SHA1 e58886076b05bce72d410a934740be6b7807f8b4
SHA256 944e62bc33948ada15bf3eff5d83e9ee51f8829097dcf620cb124aa2fd8c86fd
SHA512 8259a18c6f6440f09676545242b2d486064ceca6ca1ad9f2c5883e8c09cdeae3f2c2a35a34de01e9670447ec4e4158a13b18ef02391ec3115f4e6a499949a607

memory/2472-192-0x000000001B6A0000-0x000000001B982000-memory.dmp

memory/2472-193-0x0000000001E10000-0x0000000001E18000-memory.dmp

memory/900-196-0x0000000000090000-0x0000000000350000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-14 05:56

Reported

2024-05-14 05:58

Platform

win10v2004-20240508-en

Max time kernel

94s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\OfficeClickToRun.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\fontdrvhost.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\Idle.exe\", \"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Google\\CrashReports\\OfficeClickToRun.exe\", \"C:\\Recovery\\WindowsRE\\dwm.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\fontdrvhost.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Google\\CrashReports\\OfficeClickToRun.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\WindowsRE\\Idle.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\WindowsRE\\fontdrvhost.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files (x86)\\Google\\CrashReports\\OfficeClickToRun.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Mail\\fontdrvhost.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Windows Mail\\fontdrvhost.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Recovery\\WindowsRE\\dwm.exe\"" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\dllhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Google\CrashReports\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Mail\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Mail\5b884080fd4f94 C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Google\CrashReports\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Google\CrashReports\e6c9b481da804f C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\RCX5E8C.tmp C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\CrashReports\RCX66CD.tmp C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\dllhost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\dllhost.exe N/A

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\dllhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\dllhost.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\8cdae0ef9f7f5ab79ec5671644e1a0f0_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\CrashReports\OfficeClickToRun.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\CrashReports\OfficeClickToRun.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\90VwfBYSCa.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Recovery\WindowsRE\dllhost.exe

"C:\Recovery\WindowsRE\dllhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
RU 94.250.255.250:80 94.250.255.250 tcp
RU 94.250.255.250:443 tcp
RU 94.250.255.250:443 tcp
US 8.8.8.8:53 250.255.250.94.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/2788-0-0x00007FFFC7ED3000-0x00007FFFC7ED5000-memory.dmp

memory/2788-1-0x0000000000080000-0x0000000000340000-memory.dmp

memory/2788-2-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

memory/2788-3-0x000000001AE30000-0x000000001AE38000-memory.dmp

memory/2788-4-0x000000001AE40000-0x000000001AE5C000-memory.dmp

memory/2788-5-0x000000001B630000-0x000000001B680000-memory.dmp

memory/2788-7-0x000000001AE70000-0x000000001AE80000-memory.dmp

memory/2788-6-0x000000001AE60000-0x000000001AE68000-memory.dmp

memory/2788-8-0x000000001AFA0000-0x000000001AFB6000-memory.dmp

memory/2788-9-0x000000001AE80000-0x000000001AE88000-memory.dmp

memory/2788-10-0x000000001AFE0000-0x000000001AFE8000-memory.dmp

memory/2788-11-0x000000001AFC0000-0x000000001AFD0000-memory.dmp

memory/2788-12-0x000000001AFD0000-0x000000001AFDA000-memory.dmp

memory/2788-13-0x000000001B680000-0x000000001B6D6000-memory.dmp

memory/2788-14-0x000000001AFF0000-0x000000001AFF8000-memory.dmp

memory/2788-15-0x000000001B000000-0x000000001B008000-memory.dmp

memory/2788-16-0x000000001B010000-0x000000001B01C000-memory.dmp

memory/2788-17-0x000000001B6D0000-0x000000001B6D8000-memory.dmp

memory/2788-18-0x000000001B6E0000-0x000000001B6EC000-memory.dmp

memory/2788-19-0x000000001B6F0000-0x000000001B6FC000-memory.dmp

memory/2788-20-0x000000001B800000-0x000000001B808000-memory.dmp

memory/2788-23-0x000000001B930000-0x000000001B93C000-memory.dmp

memory/2788-22-0x000000001B820000-0x000000001B82C000-memory.dmp

memory/2788-21-0x000000001B810000-0x000000001B818000-memory.dmp

memory/2788-24-0x000000001B940000-0x000000001B948000-memory.dmp

memory/2788-27-0x000000001B990000-0x000000001B99C000-memory.dmp

memory/2788-28-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

memory/2788-26-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

memory/2788-25-0x000000001BA90000-0x000000001BA9A000-memory.dmp

memory/2788-35-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

C:\Program Files (x86)\Google\CrashReports\OfficeClickToRun.exe

MD5 8cdae0ef9f7f5ab79ec5671644e1a0f0
SHA1 dfae9279327bb5658e9d95daae768bfaf4dca42f
SHA256 e4c8b1c4527c76289bb4247f0a02d3dd85545bdc59530f005941455d05826aed
SHA512 828146a24cc9ddac7e6e4f80df37356cbaf1bf93be1540b9cc3c5e49c7a46ef49f74ef48ba23998b5c388575aa792cc3f43043aadb15ff5b21eff841f49171f6

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rhjne0pt.wwd.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1428-99-0x0000020CDC3F0000-0x0000020CDC412000-memory.dmp

memory/2788-101-0x00007FFFC7ED0000-0x00007FFFC8991000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\90VwfBYSCa.bat

MD5 6c8b46f0687c544f6fbba92af4fa5290
SHA1 ad16b70110768a20cf7e7e00bf9a6c28d03b7474
SHA256 ac613ccce7765d79a89905d6d2210dedf05f5ed369f2da2c2840ae5dacfbe48f
SHA512 70e2644a607f36f0b86a358e00020ae934b39cc1313f54c1dfbdeba1bcef4f98c3a4925fe06e1b21beecf4ce8c91e632f1e9d7b5668230ff111517b3d8bb5b54