Malware Analysis Report

2024-11-15 05:49

Sample ID 240515-bmrkrshh3s
Target 5758f08ee8daacd956d144b547105710_NeikiAnalytics
SHA256 fc7b46480fd584b41761e56b5a4ac9c99ba65f3f09f5b96fc7379aaf279c7c1c
Tags
dcrat evasion execution infostealer rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fc7b46480fd584b41761e56b5a4ac9c99ba65f3f09f5b96fc7379aaf279c7c1c

Threat Level: Known bad

The file 5758f08ee8daacd956d144b547105710_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

dcrat evasion execution infostealer rat trojan

Dcrat family

Process spawned unexpected child process

DCRat payload

UAC bypass

DcRat

DCRat payload

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Checks computer location settings

Checks whether UAC is enabled

Looks up external IP address via web service

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Modifies registry class

System policy modification

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 01:16

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 01:15

Reported

2024-05-15 01:18

Platform

win10v2004-20240508-en

Max time kernel

93s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A
N/A N/A C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backgroundTaskHost.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\eddb19405b7ce1 C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RCX718F.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backgroundTaskHost.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\TAPI\RCX6B04.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\TAPI\TextInputHost.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\L2Schemas\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\L2Schemas\9e8d7a4ca61bd9 C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\TAPI\TextInputHost.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\TAPI\22eafd247d37c3 C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\L2Schemas\RCX64F8.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\L2Schemas\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1116 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 1424 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 3232 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 704 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Recovery\WindowsRE\fontdrvhost.exe
PID 1116 wrote to memory of 4812 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Recovery\WindowsRE\fontdrvhost.exe
PID 4812 wrote to memory of 2752 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4812 wrote to memory of 2752 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4812 wrote to memory of 4820 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 4812 wrote to memory of 4820 N/A C:\Recovery\WindowsRE\fontdrvhost.exe C:\Windows\System32\WScript.exe
PID 2752 wrote to memory of 4228 N/A C:\Windows\System32\WScript.exe C:\Recovery\WindowsRE\fontdrvhost.exe
PID 2752 wrote to memory of 4228 N/A C:\Windows\System32\WScript.exe C:\Recovery\WindowsRE\fontdrvhost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Recovery\WindowsRE\fontdrvhost.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\L2Schemas\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\L2Schemas\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\L2Schemas\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "5758f08ee8daacd956d144b547105710_NeikiAnalytics5" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "5758f08ee8daacd956d144b547105710_NeikiAnalytics" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "5758f08ee8daacd956d144b547105710_NeikiAnalytics5" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\TAPI\TextInputHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\TAPI\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Windows\TAPI\TextInputHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backgroundTaskHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Recovery\WindowsRE\fontdrvhost.exe

"C:\Recovery\WindowsRE\fontdrvhost.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fcf1e752-5283-4246-9020-ba7176321f64.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84b97705-407f-4ca2-880e-b8626fdd5eb5.vbs"

C:\Recovery\WindowsRE\fontdrvhost.exe

C:\Recovery\WindowsRE\fontdrvhost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 cq15166.tw1.ru udp
RU 185.114.247.232:80 cq15166.tw1.ru tcp
US 8.8.8.8:53 vh422.timeweb.ru udp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
US 8.8.8.8:53 232.247.114.185.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/1116-0-0x00007FF9472B3000-0x00007FF9472B5000-memory.dmp

memory/1116-1-0x0000000000A80000-0x0000000000DA0000-memory.dmp

memory/1116-2-0x00007FF9472B0000-0x00007FF947D71000-memory.dmp

memory/1116-3-0x00000000016A0000-0x00000000016AE000-memory.dmp

memory/1116-4-0x00000000016B0000-0x00000000016BE000-memory.dmp

memory/1116-5-0x00007FF9472B0000-0x00007FF947D71000-memory.dmp

memory/1116-6-0x00007FF9472B0000-0x00007FF947D71000-memory.dmp

memory/1116-7-0x00007FF9472B0000-0x00007FF947D71000-memory.dmp

memory/1116-9-0x000000001C750000-0x000000001C7A0000-memory.dmp

memory/1116-12-0x000000001BB70000-0x000000001BB86000-memory.dmp

memory/1116-11-0x000000001BA40000-0x000000001BA50000-memory.dmp

memory/1116-15-0x00007FF9472B0000-0x00007FF947D71000-memory.dmp

memory/1116-14-0x000000001BB90000-0x000000001BB9A000-memory.dmp

memory/1116-10-0x000000001BA30000-0x000000001BA38000-memory.dmp

memory/1116-16-0x000000001BBA0000-0x000000001BBF6000-memory.dmp

memory/1116-13-0x000000001BA50000-0x000000001BA58000-memory.dmp

memory/1116-8-0x0000000001700000-0x000000000171C000-memory.dmp

memory/1116-18-0x000000001C7A0000-0x000000001C7AC000-memory.dmp

memory/1116-17-0x000000001BBF0000-0x000000001BBF8000-memory.dmp

memory/1116-19-0x000000001C7B0000-0x000000001C7C2000-memory.dmp

memory/1116-20-0x000000001CCF0000-0x000000001D218000-memory.dmp

memory/1116-21-0x000000001C7C0000-0x000000001C7CC000-memory.dmp

memory/1116-22-0x000000001C7D0000-0x000000001C7DC000-memory.dmp

memory/1116-24-0x000000001C7F0000-0x000000001C7FC000-memory.dmp

memory/1116-23-0x000000001C7E0000-0x000000001C7E8000-memory.dmp

memory/1116-25-0x000000001C800000-0x000000001C80C000-memory.dmp

memory/1116-27-0x000000001C920000-0x000000001C92C000-memory.dmp

memory/1116-26-0x000000001C910000-0x000000001C918000-memory.dmp

memory/1116-31-0x000000001CA60000-0x000000001CA6E000-memory.dmp

memory/1116-30-0x000000001CA50000-0x000000001CA58000-memory.dmp

memory/1116-29-0x000000001CA40000-0x000000001CA4E000-memory.dmp

memory/1116-28-0x000000001C930000-0x000000001C93A000-memory.dmp

memory/1116-32-0x000000001CA70000-0x000000001CA7C000-memory.dmp

memory/1116-33-0x000000001CA80000-0x000000001CA88000-memory.dmp

memory/1116-35-0x000000001CA90000-0x000000001CA9C000-memory.dmp

memory/1116-34-0x000000001CB90000-0x000000001CB9A000-memory.dmp

C:\Recovery\WindowsRE\dllhost.exe

MD5 5758f08ee8daacd956d144b547105710
SHA1 eb9a247be053dc3ffc9986add72c3c95b9a1dcd1
SHA256 fc7b46480fd584b41761e56b5a4ac9c99ba65f3f09f5b96fc7379aaf279c7c1c
SHA512 2cd545ddc2e51cd5cedcf8040cacf66a0d60bfba4b92635ee7b2343e65808c939cfe961d61a50ebddbbdbc302ccec3db8b0b0a2ab5d4afcfbc2a61344f7d0c24

memory/4312-176-0x00000154C4060000-0x00000154C4082000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jbymh24w.trh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1116-282-0x00007FF9472B0000-0x00007FF947D71000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 cadef9abd087803c630df65264a6c81c
SHA1 babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA512 7278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e243a38635ff9a06c87c2a61a2200656
SHA1 ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256 af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA512 4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

memory/4812-306-0x000000001B170000-0x000000001B1C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fcf1e752-5283-4246-9020-ba7176321f64.vbs

MD5 391ba7214d1e65ef0a7282574b5c243a
SHA1 43600dadb96c1fb49ee71d56de54546d062cfa78
SHA256 de51e9238b36419e3563358a25d188deadd574bcd8f13d179cd54f0af191aef8
SHA512 9c4f07fccdbf41627968fa054e4f2d812e88516edaa0902da16b7f908596f1b3406e951c8d2a32acebff861b7ba807bc5fbc32d5d0d06a0f2843cefb1635acf4

C:\Users\Admin\AppData\Local\Temp\84b97705-407f-4ca2-880e-b8626fdd5eb5.vbs

MD5 67be684c69397ec70be5cc628671dcad
SHA1 24ce9bf4ece797763c42e10f3d985b3e5e8a5ea9
SHA256 463480e92f7e1789a797a802b667668dda1a210e5f73d08b664e5a7ecfa134f9
SHA512 46163ff761719e04cc8e3871f7a5235fc27716c41e328b6fe6f2d2dccf4e72097941292bec73095e17ca7b70775725d0116c830b320ca41082e4728b06928e67

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fontdrvhost.exe.log

MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 01:15

Reported

2024-05-15 01:18

Platform

win7-20240508-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\ModemLogs\System.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\ModemLogs\System.exe N/A
N/A N/A C:\Windows\ModemLogs\System.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\ModemLogs\System.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\ModemLogs\System.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\el-GR\taskhost.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\SysWOW64\el-GR\b75386f1303e64 C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\el-GR\RCX5242.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWOW64\el-GR\taskhost.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Portable Devices\c5b4cb5e9653cc C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Portable Devices\RCX43BA.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Portable Devices\services.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\RCX4BCA.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Defender\smss.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\Office14\services.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Defender\RCX41B7.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Defender\smss.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\RCX503E.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Idle.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Defender\69ddcba757bf72 C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Idle.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\Office14\c5b4cb5e9653cc C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\6ccacd8608530f C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\services.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Portable Devices\services.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ModemLogs\RCX4DCD.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\rescache\wininit.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\debug\WIA\smss.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\ModemLogs\System.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\debug\WIA\smss.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\PCHEALTH\ERRORREP\lsm.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\PCHEALTH\ERRORREP\lsm.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\ModemLogs\System.exe C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\PCHEALTH\ERRORREP\RCX49C6.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\debug\WIA\69ddcba757bf72 C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\PCHEALTH\ERRORREP\101b941d020240 C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File created C:\Windows\ModemLogs\27d1bcfc3c54e0 C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\debug\WIA\RCX3FB3.tmp C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\ModemLogs\System.exe N/A
N/A N/A C:\Windows\ModemLogs\System.exe N/A
N/A N/A C:\Windows\ModemLogs\System.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3016 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3016 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\ModemLogs\System.exe
PID 3016 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\ModemLogs\System.exe
PID 3016 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe C:\Windows\ModemLogs\System.exe
PID 1620 wrote to memory of 1800 N/A C:\Windows\ModemLogs\System.exe C:\Windows\System32\WScript.exe
PID 1620 wrote to memory of 1800 N/A C:\Windows\ModemLogs\System.exe C:\Windows\System32\WScript.exe
PID 1620 wrote to memory of 1800 N/A C:\Windows\ModemLogs\System.exe C:\Windows\System32\WScript.exe
PID 1620 wrote to memory of 1952 N/A C:\Windows\ModemLogs\System.exe C:\Windows\System32\WScript.exe
PID 1620 wrote to memory of 1952 N/A C:\Windows\ModemLogs\System.exe C:\Windows\System32\WScript.exe
PID 1620 wrote to memory of 1952 N/A C:\Windows\ModemLogs\System.exe C:\Windows\System32\WScript.exe
PID 1800 wrote to memory of 1712 N/A C:\Windows\System32\WScript.exe C:\Windows\ModemLogs\System.exe
PID 1800 wrote to memory of 1712 N/A C:\Windows\System32\WScript.exe C:\Windows\ModemLogs\System.exe
PID 1800 wrote to memory of 1712 N/A C:\Windows\System32\WScript.exe C:\Windows\ModemLogs\System.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\ModemLogs\System.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\ModemLogs\System.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\5758f08ee8daacd956d144b547105710_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\NetHood\winlogon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\NetHood\winlogon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Application Data\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Application Data\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Windows\debug\WIA\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\debug\WIA\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Windows\debug\WIA\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\smss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Defender\smss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Portable Devices\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Templates\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Users\All Users\Templates\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Templates\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Windows\PCHEALTH\ERRORREP\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Windows\PCHEALTH\ERRORREP\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Office14\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office\Office14\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Windows\ModemLogs\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Windows\ModemLogs\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Windows\ModemLogs\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Idle.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Idle.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Windows\SysWOW64\el-GR\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\SysWOW64\el-GR\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\Windows\SysWOW64\el-GR\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\ModemLogs\System.exe

"C:\Windows\ModemLogs\System.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\340a0a56-b735-4c5d-b379-8db6c9fdba90.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\506c1e97-20ce-4a81-be97-8dfcc95d232e.vbs"

C:\Windows\ModemLogs\System.exe

C:\Windows\ModemLogs\System.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 cq15166.tw1.ru udp
RU 185.114.247.232:80 cq15166.tw1.ru tcp
US 8.8.8.8:53 vh422.timeweb.ru udp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
RU 185.114.247.232:443 vh422.timeweb.ru tcp
US 208.95.112.1:80 ip-api.com tcp

Files

memory/3016-0-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

memory/3016-1-0x0000000000A40000-0x0000000000D60000-memory.dmp

memory/3016-2-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

memory/3016-3-0x00000000003C0000-0x00000000003CE000-memory.dmp

memory/3016-4-0x00000000003D0000-0x00000000003DE000-memory.dmp

memory/3016-5-0x0000000000420000-0x000000000043C000-memory.dmp

memory/3016-6-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

memory/3016-10-0x0000000000600000-0x0000000000608000-memory.dmp

memory/3016-11-0x0000000000620000-0x000000000062A000-memory.dmp

memory/3016-9-0x00000000005E0000-0x00000000005F6000-memory.dmp

memory/3016-8-0x00000000005D0000-0x00000000005E0000-memory.dmp

memory/3016-7-0x00000000005C0000-0x00000000005C8000-memory.dmp

memory/3016-12-0x00000000024F0000-0x0000000002546000-memory.dmp

memory/3016-13-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

memory/3016-15-0x0000000000640000-0x000000000064C000-memory.dmp

memory/3016-14-0x0000000000610000-0x0000000000618000-memory.dmp

memory/3016-16-0x0000000000650000-0x0000000000662000-memory.dmp

memory/3016-18-0x0000000000670000-0x000000000067C000-memory.dmp

memory/3016-17-0x0000000000660000-0x000000000066C000-memory.dmp

memory/3016-19-0x0000000000A20000-0x0000000000A28000-memory.dmp

memory/3016-20-0x0000000000A30000-0x0000000000A3C000-memory.dmp

memory/3016-21-0x0000000002340000-0x000000000234C000-memory.dmp

memory/3016-22-0x0000000002350000-0x0000000002358000-memory.dmp

memory/3016-23-0x0000000002540000-0x000000000254C000-memory.dmp

memory/3016-24-0x00000000025D0000-0x00000000025DA000-memory.dmp

memory/3016-25-0x00000000025E0000-0x00000000025EE000-memory.dmp

memory/3016-26-0x00000000025F0000-0x00000000025F8000-memory.dmp

memory/3016-27-0x0000000002600000-0x000000000260E000-memory.dmp

memory/3016-28-0x0000000002610000-0x000000000261C000-memory.dmp

memory/3016-29-0x0000000002620000-0x0000000002628000-memory.dmp

memory/3016-30-0x0000000002630000-0x000000000263A000-memory.dmp

memory/3016-31-0x0000000002640000-0x000000000264C000-memory.dmp

C:\Program Files\Windows Defender\smss.exe

MD5 5758f08ee8daacd956d144b547105710
SHA1 eb9a247be053dc3ffc9986add72c3c95b9a1dcd1
SHA256 fc7b46480fd584b41761e56b5a4ac9c99ba65f3f09f5b96fc7379aaf279c7c1c
SHA512 2cd545ddc2e51cd5cedcf8040cacf66a0d60bfba4b92635ee7b2343e65808c939cfe961d61a50ebddbbdbc302ccec3db8b0b0a2ab5d4afcfbc2a61344f7d0c24

C:\Windows\PCHEALTH\ERRORREP\RCX49C6.tmp

MD5 66fba1d1be32d45520cc5a9771c17372
SHA1 3ba9307a4d52961f66e3d8587d632960a2325249
SHA256 b1c8559283f385a523772a5ef5fc147cb5c66636fdb604f09096e8d2b7c61805
SHA512 ab00ac8cc6e83c09bc3a87b7aa1faa59f24761c00fd9e5d00efdb162e0d28c70eecb6adcd4b9e1876004bf7f4a60023dabcaa6b19ad3dd8ef0d59d5de94a8d77

C:\Windows\ModemLogs\System.exe

MD5 104e7e067afb7f5685b9cf68c96cea34
SHA1 4884afc31acc1ec73553f397fda159b1ec4ee459
SHA256 3ae5584ada9307d62a457833cb148b6eff67ec80ade17d9cb2d2c30a891e5751
SHA512 c3cc37e6115740219cc4e10d5beef4664ded8e3df620d523fe9205d2dc30acf794f85259791cd033ca635ce89afc974f29f8030c2ef82b6ec7bb317f5d5f7895

memory/2552-163-0x000000001B500000-0x000000001B7E2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 18c548fe8639b71ede6b439e9e5efd6b
SHA1 0ce5be64c0e5cb90354d9388eafc89b0ddcfea52
SHA256 23dc834e172defa19253b1d7b5f4e1393d5e5306df2409ea9438ecf14a24b8e2
SHA512 48c10a288de4303a455290709b75ce8cea046d9bb787b8b68e85e168a0d25e3373f761506b6d394ad4454a0c352c15be715e9f0851357205990ef9a25e0b1185

memory/2552-172-0x0000000002910000-0x0000000002918000-memory.dmp

memory/1620-222-0x00000000009E0000-0x0000000000D00000-memory.dmp

memory/3016-223-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\340a0a56-b735-4c5d-b379-8db6c9fdba90.vbs

MD5 c488c2273ca32e8270ff525e2af93b7a
SHA1 d84a2ffeee6ab16794777edfab95b8b32dabd89e
SHA256 67413a746cea8d534dde0f8061f3b343cd861203a098da82cacb1527994cab69
SHA512 68634a738c5d92f10ad63e35824b47e04caecd57dd9227edd9fe0e2710a2f86e456383f00b16fe5b1dc86f00dc3752fd69025784c0d35c30d683fcfb47eab773

C:\Users\Admin\AppData\Local\Temp\Cab86FD.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar871F.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

memory/1712-339-0x0000000000190000-0x00000000004B0000-memory.dmp