Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe
-
Size
77KB
-
MD5
b972c00bf289a05a128a74d75f723c20
-
SHA1
38d43b1bf3f39b04a50a89776bb1b14961a6a4e4
-
SHA256
6d9f005b96f1ce8f3c0b009b36137155fb9e0eef124ee9be9c8575692837b91e
-
SHA512
91ec22d0c55f01dd78f5968d90ce25c96102fbf4843e60da3e39ad8ff2ba4ce59706d95e4ebf247d90a3b4ee17f589f43c1b4ac35b1bb7e17c779f68ac8e4078
-
SSDEEP
1536:ekeK40T/mx7y9v7Z/Z2V/GSAFRfBhpVoK5:FD40Dmx7y9DZ/Z2hGVkK5
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe -
Executes dropped EXE 12 IoCs
pid Process 1764 SVCHOST.EXE 1020 SVCHOST.EXE 1200 SVCHOST.EXE 728 SVCHOST.EXE 636 SVCHOST.EXE 2568 SPOOLSV.EXE 4588 SVCHOST.EXE 3568 SVCHOST.EXE 3360 SPOOLSV.EXE 4048 SPOOLSV.EXE 3684 SVCHOST.EXE 1600 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\P: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\O: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\K: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\L: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\M: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\H: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\I: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\G: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\Y: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\W: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\Q: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\E: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\Z: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\R: b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\TileInfo = "prop:Type;Size" b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\InfoTip = "prop:Type;Write;Size" b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\QuickTip = "prop:Type;Size" b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 624 WINWORD.EXE 624 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 2568 SPOOLSV.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1764 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 1200 SVCHOST.EXE 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 1764 SVCHOST.EXE 1020 SVCHOST.EXE 1200 SVCHOST.EXE 728 SVCHOST.EXE 636 SVCHOST.EXE 2568 SPOOLSV.EXE 4588 SVCHOST.EXE 3568 SVCHOST.EXE 3360 SPOOLSV.EXE 4048 SPOOLSV.EXE 3684 SVCHOST.EXE 1600 SPOOLSV.EXE 624 WINWORD.EXE 624 WINWORD.EXE 624 WINWORD.EXE 624 WINWORD.EXE 624 WINWORD.EXE 624 WINWORD.EXE 624 WINWORD.EXE -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 400 wrote to memory of 1764 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 89 PID 400 wrote to memory of 1764 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 89 PID 400 wrote to memory of 1764 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 89 PID 1764 wrote to memory of 1020 1764 SVCHOST.EXE 90 PID 1764 wrote to memory of 1020 1764 SVCHOST.EXE 90 PID 1764 wrote to memory of 1020 1764 SVCHOST.EXE 90 PID 1764 wrote to memory of 1200 1764 SVCHOST.EXE 91 PID 1764 wrote to memory of 1200 1764 SVCHOST.EXE 91 PID 1764 wrote to memory of 1200 1764 SVCHOST.EXE 91 PID 1200 wrote to memory of 728 1200 SVCHOST.EXE 92 PID 1200 wrote to memory of 728 1200 SVCHOST.EXE 92 PID 1200 wrote to memory of 728 1200 SVCHOST.EXE 92 PID 1200 wrote to memory of 636 1200 SVCHOST.EXE 94 PID 1200 wrote to memory of 636 1200 SVCHOST.EXE 94 PID 1200 wrote to memory of 636 1200 SVCHOST.EXE 94 PID 1200 wrote to memory of 2568 1200 SVCHOST.EXE 95 PID 1200 wrote to memory of 2568 1200 SVCHOST.EXE 95 PID 1200 wrote to memory of 2568 1200 SVCHOST.EXE 95 PID 2568 wrote to memory of 4588 2568 SPOOLSV.EXE 96 PID 2568 wrote to memory of 4588 2568 SPOOLSV.EXE 96 PID 2568 wrote to memory of 4588 2568 SPOOLSV.EXE 96 PID 2568 wrote to memory of 3568 2568 SPOOLSV.EXE 97 PID 2568 wrote to memory of 3568 2568 SPOOLSV.EXE 97 PID 2568 wrote to memory of 3568 2568 SPOOLSV.EXE 97 PID 2568 wrote to memory of 3360 2568 SPOOLSV.EXE 99 PID 2568 wrote to memory of 3360 2568 SPOOLSV.EXE 99 PID 2568 wrote to memory of 3360 2568 SPOOLSV.EXE 99 PID 1764 wrote to memory of 4048 1764 SVCHOST.EXE 100 PID 1764 wrote to memory of 4048 1764 SVCHOST.EXE 100 PID 1764 wrote to memory of 4048 1764 SVCHOST.EXE 100 PID 400 wrote to memory of 3684 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 101 PID 400 wrote to memory of 3684 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 101 PID 400 wrote to memory of 3684 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 101 PID 1764 wrote to memory of 2604 1764 SVCHOST.EXE 102 PID 1764 wrote to memory of 2604 1764 SVCHOST.EXE 102 PID 1764 wrote to memory of 2604 1764 SVCHOST.EXE 102 PID 400 wrote to memory of 1600 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 103 PID 400 wrote to memory of 1600 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 103 PID 400 wrote to memory of 1600 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 103 PID 2604 wrote to memory of 4364 2604 userinit.exe 104 PID 2604 wrote to memory of 4364 2604 userinit.exe 104 PID 2604 wrote to memory of 4364 2604 userinit.exe 104 PID 400 wrote to memory of 624 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 107 PID 400 wrote to memory of 624 400 b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1020
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:728
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:636
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4588
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3568
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3360
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4048
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵PID:4364
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3684
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1600
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b972c00bf289a05a128a74d75f723c20_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:624
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5000
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4220,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:81⤵PID:2248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD578e10075d86b10040ab401262d49bb2d
SHA199f566f5890c3949e0f8694fc43b25f2ee74422e
SHA256d8dba16ece18ddfa6b097fa270a34713857e0ab65b6eab89f807b14dc041f7c2
SHA512855cb515ffd5fbd98a2fafcbdcd535749ab83e3dba8f7550260b517b2b33169dd7c9b363dcedaaaf190bbcccbd098c0f2230c82a535d48966ec70328cd90f6ff
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl
Filesize263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
77KB
MD502c08d54afeaeb66cfb96d3366f4ba13
SHA1bbfdce3ce7b2c02fec12e3d0fc634337dc7fd7c5
SHA256a3bbfac55610b22696727c5a627d8baad90de394481b35c99d06846ee5576124
SHA512b3790d598fc78c6a1943a6faee0c72f0172bc4c1259d0e09171ed6012158ab64368a9482fad69d2afec7728fcee6f17733b6ae23271a1f7ccbeba7fb45e01000
-
Filesize
77KB
MD50bb1bad676c18e19c8eae26d2d7b9ed4
SHA18b06f54cee253680409822aeb4da2a0b1152830e
SHA256d8178a7cef1e3606a487f61be746274367e7d5ea7e18170d92df3dfac98a2d78
SHA51296cb958b3c3e8d8e9bb71bc9f5ee6cf62c15195e8a2c57558371e5686e9878a275f48e3a5790db32d54823b7f13a4395588f8fdeaeb3d56eaa3fda52679d88b5