Malware Analysis Report

2024-11-13 13:43

Sample ID 240515-rwbtnsdh22
Target d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics
SHA256 ba381b7847ed129aa068cee625f78d7a8ec511a55d55feb86e22159ab43b6357
Tags
rat dcrat evasion execution infostealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ba381b7847ed129aa068cee625f78d7a8ec511a55d55feb86e22159ab43b6357

Threat Level: Known bad

The file d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

rat dcrat evasion execution infostealer trojan

Process spawned unexpected child process

DcRat

Dcrat family

UAC bypass

DCRat payload

DCRat payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

System policy modification

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Creates scheduled task(s)

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 14:32

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 14:32

Reported

2024-05-15 14:34

Platform

win7-20240215-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\System.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\RCX1F85.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\RCX2D94.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\System.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\csrss.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\886983d96e3d3e C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\6cb0b6c459d5d3 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\bin\27d1bcfc3c54e0 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\RCX1F17.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\RCX28A0.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\RCX290F.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\RCX2D95.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\csrss.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Logs\dwm.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Windows\Logs\6cb0b6c459d5d3 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Logs\RCX2B12.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Logs\RCX2B81.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Logs\dwm.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
N/A N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2356 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1916 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 936 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2356 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 2356 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\cmd.exe
PID 1532 wrote to memory of 2772 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1532 wrote to memory of 2772 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1532 wrote to memory of 2772 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 1532 wrote to memory of 1564 N/A C:\Windows\System32\cmd.exe C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe
PID 1532 wrote to memory of 1564 N/A C:\Windows\System32\cmd.exe C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe
PID 1532 wrote to memory of 1564 N/A C:\Windows\System32\cmd.exe C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe
PID 1564 wrote to memory of 1256 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1564 wrote to memory of 1256 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1564 wrote to memory of 1256 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1564 wrote to memory of 828 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1564 wrote to memory of 828 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1564 wrote to memory of 828 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1256 wrote to memory of 1464 N/A C:\Windows\System32\WScript.exe C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe
PID 1256 wrote to memory of 1464 N/A C:\Windows\System32\WScript.exe C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe
PID 1256 wrote to memory of 1464 N/A C:\Windows\System32\WScript.exe C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe
PID 1464 wrote to memory of 2960 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1464 wrote to memory of 2960 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1464 wrote to memory of 2960 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1464 wrote to memory of 2760 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1464 wrote to memory of 2760 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 1464 wrote to memory of 2760 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe
PID 2960 wrote to memory of 2964 N/A C:\Windows\System32\WScript.exe C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe
PID 2960 wrote to memory of 2964 N/A C:\Windows\System32\WScript.exe C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe
PID 2960 wrote to memory of 2964 N/A C:\Windows\System32\WScript.exe C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe
PID 2964 wrote to memory of 2368 N/A C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "d67c083b7f55c40deae2ac79549d0a70_NeikiAnalyticsd" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics" /sc ONLOGON /tr "'C:\Users\Default User\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "d67c083b7f55c40deae2ac79549d0a70_NeikiAnalyticsd" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Windows\Logs\dwm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Logs\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\Logs\dwm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk1.7.0_80\db\bin\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\db\bin\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jdk1.7.0_80\db\bin\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Music\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Music\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Music\csrss.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3yp8Lh1nvX.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9134db37-908c-4b12-8154-6872eb89f89b.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58c75df5-17af-4ea8-a9ca-29efd4cbb70e.vbs"

C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2ef3bd7f-27d8-4e40-a9ea-25b2948042f2.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b6a85ec2-deac-4ec4-8695-07e27c00e29e.vbs"

C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b9814e38-6d80-41d9-9906-d36b3bb5075a.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c816ef90-c2c0-4528-a898-094a42074b6b.vbs"

C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\714850e1-a388-4ed6-87ee-c07bc82a70f1.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e267d95c-20ad-4ce0-a1a7-b5fbb846c075.vbs"

C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6531ce0e-8e9c-42ec-af19-042b51cdd3c8.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15b2e935-933f-4737-a8f7-7e5f68b9f9c4.vbs"

C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe

"C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d6eba3c7-eaa4-48fb-b106-55e8c1e08021.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ac8e8718-061d-43e2-902f-e6527e055f53.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 a0887556.xsph.ru udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp

Files

memory/2356-0-0x000007FEF5C93000-0x000007FEF5C94000-memory.dmp

memory/2356-1-0x00000000013C0000-0x00000000016FC000-memory.dmp

memory/2356-2-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

memory/2356-3-0x0000000000630000-0x000000000063E000-memory.dmp

memory/2356-4-0x0000000000640000-0x000000000064E000-memory.dmp

memory/2356-5-0x0000000000650000-0x0000000000658000-memory.dmp

memory/2356-6-0x0000000000B00000-0x0000000000B1C000-memory.dmp

memory/2356-7-0x0000000000B20000-0x0000000000B28000-memory.dmp

memory/2356-8-0x0000000000B30000-0x0000000000B40000-memory.dmp

memory/2356-9-0x0000000000B40000-0x0000000000B56000-memory.dmp

memory/2356-10-0x0000000000B60000-0x0000000000B68000-memory.dmp

memory/2356-11-0x0000000000D10000-0x0000000000D20000-memory.dmp

memory/2356-12-0x0000000000B70000-0x0000000000B7A000-memory.dmp

memory/2356-13-0x0000000000D20000-0x0000000000D76000-memory.dmp

memory/2356-14-0x0000000000D70000-0x0000000000D7C000-memory.dmp

memory/2356-15-0x0000000000D80000-0x0000000000D88000-memory.dmp

memory/2356-16-0x0000000000D90000-0x0000000000D9C000-memory.dmp

memory/2356-17-0x0000000000DA0000-0x0000000000DA8000-memory.dmp

memory/2356-18-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

memory/2356-19-0x0000000000DC0000-0x0000000000DCC000-memory.dmp

memory/2356-20-0x0000000000E70000-0x0000000000E7C000-memory.dmp

memory/2356-21-0x0000000000E80000-0x0000000000E8C000-memory.dmp

memory/2356-22-0x0000000001310000-0x000000000131C000-memory.dmp

memory/2356-23-0x0000000001340000-0x0000000001348000-memory.dmp

memory/2356-25-0x0000000001330000-0x000000000133E000-memory.dmp

memory/2356-24-0x0000000001320000-0x000000000132A000-memory.dmp

memory/2356-26-0x0000000001350000-0x0000000001358000-memory.dmp

memory/2356-27-0x0000000001360000-0x000000000136E000-memory.dmp

memory/2356-28-0x0000000001370000-0x000000000137C000-memory.dmp

memory/2356-29-0x0000000001380000-0x0000000001388000-memory.dmp

memory/2356-30-0x0000000001390000-0x000000000139A000-memory.dmp

memory/2356-31-0x00000000013A0000-0x00000000013AC000-memory.dmp

memory/2356-33-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe

MD5 d67c083b7f55c40deae2ac79549d0a70
SHA1 c47be45497fe044d732a847a21b7b2be0172c8c5
SHA256 ba381b7847ed129aa068cee625f78d7a8ec511a55d55feb86e22159ab43b6357
SHA512 2fb0a24efd4e6349cc1f0f4193ac1b512dcb679478b65f51fb967b6c736192eb0e161e7020756e4a9ce03f89aae7789bac5ce57c0968ee60b095a25654511d6d

C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\csrss.exe

MD5 3a33e5a04cd8b8c8307752388207dc1a
SHA1 fb57277e38b57f85af77a31200de26063d7df85f
SHA256 953cf28191b60da96eb3e87d8408aaa7c01c6223c08e0adad7671f4f27e695c4
SHA512 dcf381697fb724671122a58bbbe7def5ac6902c724570cd8ffe228749d4ad0b4d0356b91722f7586d0dfd7b8a7940619e2a53a5354c8bf810771a8e8454c0ffd

C:\MSOCache\All Users\audiodg.exe

MD5 a9382b0e5528f538177a02ac9485e0f4
SHA1 cf257b4b581a1ae426d8ec96f2f18b963909a34c
SHA256 e1bf9aa08427c45662b6551d255a7e9bbb9298703f0f6df816605ebfbd7b862e
SHA512 e823d0a7b2b44fe45ebdc02504966b718e1d0dad6e2b1942bc471ab01f63c5cc70039a5d336b2d36b4f3846f75983c2d3f50016f76e31c288e0315a28610160f

C:\Users\Default\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe

MD5 89ff31d6a931341d5a995367563b009c
SHA1 5ce3cc6ed6d60539df9a8f3a0a4fdc1caedc3c37
SHA256 32c54d19bd25400ce79156134decf0fb9f8b60af4348b9c51d2191d0e24fc5f4
SHA512 324de36b3d825752cb0be531e06c50ef5546eacca055709a97901abb1b723901f4d9ada8edfd7306aefcdf337b93ae8a7d5a4662820ac145fe36f8750a0b69fc

C:\Windows\Logs\dwm.exe

MD5 f51362637a046fb59a57a28a7429ce7f
SHA1 86f4b73d317aca098c5562b2d64774effffb3154
SHA256 81a54ea1e6061a553c5faae1bd832d1b73b6ecc5e99f560a07d5acbf3eb7f16f
SHA512 46d63189f2ea296d39b4b957d6562c0937a3e4ca0177af927dc2a336c7901a827ab9b80a03e9c2711e3a0cf6beca3c9e6920ae2701fe3b3c83a82f06fc102536

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 0c593b918755e4b8a6cfcab58f085055
SHA1 6ebae35451c5dd70d39ab2acc69aa3eb1bb646c3
SHA256 f9cfc437ca8b28fa7ca4814a1a355f23c3f61d9fc72ceb9170e4c15fbc504c66
SHA512 a8db93afea73a749155cef28e14cea256b62078d0e2af576f69ccbe354c0fb8b87d7ac8243b41179c65b656117440fcd2a344106c0dd59107c912f2b6a5d540b

memory/2356-201-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

memory/2052-190-0x0000000002240000-0x0000000002248000-memory.dmp

memory/1904-183-0x000000001B530000-0x000000001B812000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3yp8Lh1nvX.bat

MD5 d98553e5cad699375e6f5609503766ea
SHA1 48f1207aae37d2b57cfb45744946b033fcec28a0
SHA256 0f029a31cb333eaf2154dc3f30d45046f231bb5d34028ef1ba2925350d37e2ca
SHA512 938978a305c004d146b821111abcfe2570477c4355cd46a800ee9e8d53d3652717990f8f52c120c976170fa2b639203a632e062aaa39e37dfb23875d802ac5a9

C:\Program Files\Java\jdk1.7.0_80\lib\dwm.exe

MD5 c2e6edfcd164140d119c34b8d87846e7
SHA1 e5ba0d0054ce6ed33380d1725494e0165fb054ed
SHA256 8085200e428b8bb216943bf5a1cf9be4227616ba36559eadf695ee562f4347c7
SHA512 da571d98d4ada33bff0f576255071742bdb4e560274342683edb9fdb0a55d786799c3edcc4a4764942c0031fe36cc6eeceef33ea112db67b020d8fae549c6bd6

memory/1564-215-0x00000000009F0000-0x0000000000D2C000-memory.dmp

memory/1564-216-0x0000000002270000-0x00000000022C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9134db37-908c-4b12-8154-6872eb89f89b.vbs

MD5 7dcbe23f4b0b76096638647aa5cf0767
SHA1 f221e39534e2a5e7ec5bae2325a0e331d7028a17
SHA256 6905faf0688998490a3e9eb8a0e5d9e44f437a71139c5ae8b63e341f03b4e1ee
SHA512 ba23fc15f030b381a6c57ae41b3f4880009391e4578986be1ac13c8740f66900335439635b7f0cbda6f8fc7e29105e5c4a26be9ec4e66a43c8944b24116f76b2

C:\Users\Admin\AppData\Local\Temp\58c75df5-17af-4ea8-a9ca-29efd4cbb70e.vbs

MD5 55d194b3f7b4a49c4b52c62036e2071f
SHA1 d6985145b3e9618ab02ce8e6307dcc6e80907002
SHA256 5063cf201d635d92ab187f0ae47405607a55b099cc0ee6c162a0246f9854c337
SHA512 a0f8744a3ab4c2d3d64c4cc20d3b85fa751be415b5b742dfca02e3ce7e967168e575c43bd2f9e7bc69906478b7a9af57e32d3c1e3cd6ef54cfa4a04176c3cec3

memory/1464-227-0x0000000000F90000-0x00000000012CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2ef3bd7f-27d8-4e40-a9ea-25b2948042f2.vbs

MD5 2ba016bd7f779a60a1cf08aeb927c521
SHA1 8f1fa1df85ea1c3021ffabe37a72751f088bc5fa
SHA256 2a7187d2856eb5fa697eb040bb130c69b4a562e52a09a9654520e16baa04a9cc
SHA512 cd145fe7146da2dd24b2c3aa2243981f2d8caae27165c0b4b499cc1d74add3f55036535514a134a2c468f35655ce755e3eac5b1f5df0c97a709b82b82e79693c

memory/2964-239-0x0000000000C00000-0x0000000000C12000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\b9814e38-6d80-41d9-9906-d36b3bb5075a.vbs

MD5 1ff1fd826a3801df7dcf0216a07e8191
SHA1 fd8adc92eac578cb0197d19faa37b353a3497fd9
SHA256 d6bdc85b1972d4ddf0f5aaa57d006e0445abb8f1ac6781a1f2f4cec065fea43e
SHA512 eaea1a9a239d6008b411f215ee06598ecb14398c25272c221d2a1e6b7eac7a8b22526cbc7013a532bd666ca0c2cbb349b970db0f1b43508b934bc4b40202cfa7

memory/356-251-0x0000000000680000-0x00000000006D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\714850e1-a388-4ed6-87ee-c07bc82a70f1.vbs

MD5 2db7e84b39a0eff0e971a663dedc925b
SHA1 8f66d477d16dc346f1b09a4fe7aa855cfd20d0ea
SHA256 2a04bc334688368354f1b801957592fbc60ef723802fe50942c28c9a973df436
SHA512 c0285a40ad82505289ffd86c72e321de7a14345db0996942343d63c3d89ca5ec0f8e64f0721df5dc70950fbbbb9916907a10089f39bbbb6871237ba62adb48df

C:\Users\Admin\AppData\Local\Temp\6531ce0e-8e9c-42ec-af19-042b51cdd3c8.vbs

MD5 7fb92710702106d4902aa38dd194e831
SHA1 f52f00ab9f0c3d8f1ecdec5d08d7871f58e4104d
SHA256 c16f57af284e584ec44a41a487da675d0617b6a6609e5a14ae4f92d29c80ec09
SHA512 97086aa014a2f63c9b0d67166b7dd3d92500faeb997d72f1e4c9027bf60454c7cd3df4faa6eeb470145e4326efeb7b89c80c0604267574ac1fc8df7ce3f84d80

C:\Users\Admin\AppData\Local\Temp\f45c816abc36ba74a05acc781878969903929c42.exe

MD5 eebb17b29687bc43259824ce63c5e613
SHA1 078522051bf1f3a997b6f22f182080703decee4d
SHA256 bb8a31d97262f91161a5bfc00285daf29da15ea036c6ba82508ebc7319fdd0b1
SHA512 3204df660da0ec97c43c114f98fab70bb339ccef345fbef434606404cad37851e9615847a659ad904463b2b547e6d612e25b0121633b8d128e73bc09fae9abfe

C:\Users\Admin\AppData\Local\Temp\d6eba3c7-eaa4-48fb-b106-55e8c1e08021.vbs

MD5 5210ab4f6aef9e325d8c71ccee5ed4fd
SHA1 29ca1e9f88c72114f58ded432f82b0d5c73d577d
SHA256 5537e4b3f6d6a5b1e618288a1f49aef6335ce7af78d7fe2b5b025ecd94aba5c6
SHA512 aee56b18856601cb7aa331c8da7cabf31b04af9e4e6378b21b1e7b74ac130972f9e525d662584b6304252df8577414dca7cca42c2c78f060d5630521a22164dd

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 14:32

Reported

2024-05-15 14:34

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe"

Signatures

DcRat

rat infostealer dcrat

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\Fonts\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\Fonts\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\Fonts\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\Fonts\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\Fonts\sysmon.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\Fonts\sysmon.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\Fonts\sysmon.exe N/A
N/A N/A C:\Windows\Fonts\sysmon.exe N/A
N/A N/A C:\Windows\Fonts\sysmon.exe N/A
N/A N/A C:\Windows\Fonts\sysmon.exe N/A
N/A N/A C:\Windows\Fonts\sysmon.exe N/A
N/A N/A C:\Windows\Fonts\sysmon.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Fonts\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Internet Explorer\images\5940a34987c991 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\7a0fd90576e088 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\services.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RCX6D5F.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\upfc.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\RCX768F.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office 15\SearchApp.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office 15\38384e6a620884 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\images\RCX6925.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Multimedia Platform\9e8d7a4ca61bd9 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\55b276f4edf653 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\RCX61EA.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX6F74.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\RCX82DD.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\c5b4cb5e9653cc C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\upfc.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\StartMenuExperienceHost.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\System.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\RCX768E.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\System.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Internet Explorer\images\dllhost.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\ea1d8f6d871115 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\RCX6625.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\images\dllhost.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\MSBuild\Microsoft\services.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\images\RCX68A7.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\RCX6D5E.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\RCX6F73.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\Accessories\RCX835B.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows NT\Accessories\27d1bcfc3c54e0 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Multimedia Platform\RCX5FD5.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Multimedia Platform\RCX5FD6.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\RCX61EB.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\SearchApp.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\RCX6624.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Performance\backgroundTaskHost.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Windows\Performance\eddb19405b7ce1 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Windows\Help\5b884080fd4f94 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Windows\ModemLogs\ea1d8f6d871115 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Help\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Fonts\RCX7BA4.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Windows\Help\fontdrvhost.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Windows\Fonts\121e5b5079f7c0 C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\ModemLogs\upfc.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Fonts\RCX7B26.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\ModemLogs\RCX7DA8.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Windows\Fonts\sysmon.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File created C:\Windows\ModemLogs\upfc.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Performance\RCX7189.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Performance\RCX7207.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Performance\backgroundTaskHost.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Help\RCX7912.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\ModemLogs\RCX7E26.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Help\RCX7911.tmp C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\Fonts\sysmon.exe C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\Fonts\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\Fonts\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\Fonts\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\Fonts\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\Fonts\sysmon.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\Fonts\sysmon.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Fonts\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Fonts\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Fonts\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Fonts\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Fonts\sysmon.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Fonts\sysmon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1224 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 4444 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 1792 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1224 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\Fonts\sysmon.exe
PID 1224 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe C:\Windows\Fonts\sysmon.exe
PID 3476 wrote to memory of 4192 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3476 wrote to memory of 4192 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3476 wrote to memory of 4972 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3476 wrote to memory of 4972 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 4192 wrote to memory of 2492 N/A C:\Windows\System32\WScript.exe C:\Windows\Fonts\sysmon.exe
PID 4192 wrote to memory of 2492 N/A C:\Windows\System32\WScript.exe C:\Windows\Fonts\sysmon.exe
PID 2492 wrote to memory of 1580 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 2492 wrote to memory of 1580 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 2492 wrote to memory of 2808 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 2492 wrote to memory of 2808 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 1580 wrote to memory of 5036 N/A C:\Windows\System32\WScript.exe C:\Windows\Fonts\sysmon.exe
PID 1580 wrote to memory of 5036 N/A C:\Windows\System32\WScript.exe C:\Windows\Fonts\sysmon.exe
PID 5036 wrote to memory of 3756 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 5036 wrote to memory of 3756 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 5036 wrote to memory of 1888 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 5036 wrote to memory of 1888 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3756 wrote to memory of 3168 N/A C:\Windows\System32\WScript.exe C:\Windows\Fonts\sysmon.exe
PID 3756 wrote to memory of 3168 N/A C:\Windows\System32\WScript.exe C:\Windows\Fonts\sysmon.exe
PID 3168 wrote to memory of 4908 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3168 wrote to memory of 4908 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3168 wrote to memory of 1292 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3168 wrote to memory of 1292 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 4908 wrote to memory of 3396 N/A C:\Windows\System32\WScript.exe C:\Windows\Fonts\sysmon.exe
PID 4908 wrote to memory of 3396 N/A C:\Windows\System32\WScript.exe C:\Windows\Fonts\sysmon.exe
PID 3396 wrote to memory of 3532 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3396 wrote to memory of 3532 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3396 wrote to memory of 776 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3396 wrote to memory of 776 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3532 wrote to memory of 3236 N/A C:\Windows\System32\WScript.exe C:\Windows\Fonts\sysmon.exe
PID 3532 wrote to memory of 3236 N/A C:\Windows\System32\WScript.exe C:\Windows\Fonts\sysmon.exe
PID 3236 wrote to memory of 4544 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3236 wrote to memory of 4544 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3236 wrote to memory of 2232 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe
PID 3236 wrote to memory of 2232 N/A C:\Windows\Fonts\sysmon.exe C:\Windows\System32\WScript.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Windows\Fonts\sysmon.exe N/A

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\d67c083b7f55c40deae2ac79549d0a70_NeikiAnalytics.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Multimedia Platform\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Microsoft Office 15\SearchApp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Microsoft Office 15\SearchApp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\services.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\services.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\images\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\images\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\images\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\upfc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\Registration\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\explorer.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\backgroundTaskHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Performance\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\backgroundTaskHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Mozilla Firefox\browser\StartMenuExperienceHost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\browser\StartMenuExperienceHost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\Help\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Help\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\Help\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 12 /tr "'C:\Windows\Fonts\sysmon.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\Fonts\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Windows\Fonts\sysmon.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Windows\ModemLogs\upfc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\ModemLogs\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Windows\ModemLogs\upfc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Pictures\Camera Roll\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Camera Roll\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\Pictures\Camera Roll\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\Accessories\System.exe'" /rl HIGHEST /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'

C:\Windows\Fonts\sysmon.exe

"C:\Windows\Fonts\sysmon.exe"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\faddd38c-ce1b-4671-9b8e-b9ebc2a9cbc2.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e1f30b00-fc7d-457e-b424-7247b1372cc5.vbs"

C:\Windows\Fonts\sysmon.exe

C:\Windows\Fonts\sysmon.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07ff5301-3cb1-409a-8ccd-184d8b2912dc.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8bb198b2-fa1e-4c96-8ca5-3153e05cc1f8.vbs"

C:\Windows\Fonts\sysmon.exe

C:\Windows\Fonts\sysmon.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1005c37e-541d-4f19-a03a-bb55c4d01f46.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\473f913f-e1ea-40d7-a9fd-19d54913f4a6.vbs"

C:\Windows\Fonts\sysmon.exe

C:\Windows\Fonts\sysmon.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aad207a3-8e95-4357-b30e-50a06a4d5c45.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1dcf7ad7-b4ff-4c87-a20c-91c3e414def8.vbs"

C:\Windows\Fonts\sysmon.exe

C:\Windows\Fonts\sysmon.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\69b23107-1c51-4a3a-a353-bfa1ad404d47.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df06015f-b1d1-499f-99fc-2c83191ac0a8.vbs"

C:\Windows\Fonts\sysmon.exe

C:\Windows\Fonts\sysmon.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8af7815c-56d8-4e22-ad73-41edb9d735d5.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b541f5d2-5424-47c8-8f8e-d8221f796a35.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
NL 23.62.61.185:443 www.bing.com tcp
US 8.8.8.8:53 185.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 a0887556.xsph.ru udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 42.197.8.141.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp
RU 141.8.197.42:80 a0887556.xsph.ru tcp

Files

memory/1224-1-0x0000000000CC0000-0x0000000000FFC000-memory.dmp

memory/1224-0-0x00007FFF7CB13000-0x00007FFF7CB15000-memory.dmp

memory/1224-2-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

memory/1224-3-0x0000000003210000-0x000000000321E000-memory.dmp

memory/1224-4-0x000000001BC00000-0x000000001BC0E000-memory.dmp

memory/1224-5-0x000000001BD20000-0x000000001BD28000-memory.dmp

memory/1224-6-0x000000001BD30000-0x000000001BD4C000-memory.dmp

memory/1224-7-0x000000001BDA0000-0x000000001BDF0000-memory.dmp

memory/1224-11-0x000000001BD90000-0x000000001BD98000-memory.dmp

memory/1224-10-0x000000001BD70000-0x000000001BD86000-memory.dmp

memory/1224-9-0x000000001BD60000-0x000000001BD70000-memory.dmp

memory/1224-8-0x000000001BD50000-0x000000001BD58000-memory.dmp

memory/1224-12-0x000000001C300000-0x000000001C310000-memory.dmp

memory/1224-13-0x000000001C310000-0x000000001C31A000-memory.dmp

memory/1224-14-0x000000001C320000-0x000000001C376000-memory.dmp

memory/1224-15-0x000000001C370000-0x000000001C37C000-memory.dmp

memory/1224-16-0x000000001C380000-0x000000001C388000-memory.dmp

memory/1224-17-0x000000001C490000-0x000000001C49C000-memory.dmp

memory/1224-18-0x000000001C390000-0x000000001C398000-memory.dmp

memory/1224-19-0x000000001C3A0000-0x000000001C3B2000-memory.dmp

memory/1224-20-0x000000001C9D0000-0x000000001CEF8000-memory.dmp

memory/1224-21-0x000000001C3D0000-0x000000001C3DC000-memory.dmp

memory/1224-22-0x000000001C3E0000-0x000000001C3EC000-memory.dmp

memory/1224-23-0x000000001C3F0000-0x000000001C3FC000-memory.dmp

memory/1224-24-0x000000001C400000-0x000000001C40C000-memory.dmp

memory/1224-25-0x000000001C410000-0x000000001C418000-memory.dmp

memory/1224-30-0x000000001C460000-0x000000001C46C000-memory.dmp

memory/1224-26-0x000000001C420000-0x000000001C42A000-memory.dmp

memory/1224-32-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

memory/1224-34-0x000000001C6E0000-0x000000001C6EC000-memory.dmp

memory/1224-33-0x000000001C480000-0x000000001C48A000-memory.dmp

memory/1224-31-0x000000001C470000-0x000000001C478000-memory.dmp

memory/1224-35-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

memory/1224-27-0x000000001C430000-0x000000001C43E000-memory.dmp

memory/1224-29-0x000000001C450000-0x000000001C45E000-memory.dmp

memory/1224-28-0x000000001C440000-0x000000001C448000-memory.dmp

C:\Program Files (x86)\Internet Explorer\images\dllhost.exe

MD5 d67c083b7f55c40deae2ac79549d0a70
SHA1 c47be45497fe044d732a847a21b7b2be0172c8c5
SHA256 ba381b7847ed129aa068cee625f78d7a8ec511a55d55feb86e22159ab43b6357
SHA512 2fb0a24efd4e6349cc1f0f4193ac1b512dcb679478b65f51fb967b6c736192eb0e161e7020756e4a9ce03f89aae7789bac5ce57c0968ee60b095a25654511d6d

C:\Program Files (x86)\Internet Explorer\images\dllhost.exe

MD5 1320ddaa154d7ab22e2a738a0d6c8d7b
SHA1 416aea2a6e2378fa7bb5e478c18eeee98f3c13c7
SHA256 8cef5661fb2f20706ec8a7f0ed3e5e305ebc1a844f9268a45b354ccc6a1b00b5
SHA512 69e414ee0f5f4ff7c59b7aaaac6d3ba5ef8fbf16ce4a5122224dfb1696153e545128e292f4fe88642f302b183dee248926d6181ae09b73085bba10b562c07a0a

C:\Windows\Performance\backgroundTaskHost.exe

MD5 f1389e0576e96fc0209a6eb53a780b68
SHA1 a354c1df46ede577337b093bd9e5b3fbc6e3a18a
SHA256 9af5678a1b89e4036ad81457b0a5d52264fb20cfba489f4f04ab323b5ed77eed
SHA512 57ade46a978dde84843b47f18f3d2a229ff8c964e1442c329dccbab593b24cea4241d2ed12500f9649a96a22fddf5c41a8a1c2afe8641f9f909491c9f62b2cc8

C:\Windows\Fonts\sysmon.exe

MD5 f4681fa967ba0859ab216a8669ff3b41
SHA1 835da04c16f96cf0544561e5f812f1f41fd692a4
SHA256 1c0a754c127a1c4f5c349d2228135d135f0937a5de1a6eabbbdb13702e321517
SHA512 f34e95c794b9fb842c03ac020bc9249c99d5e7ece3d3a9e8c1e4bbf5f7ce8328919980a82dfe7af5450d61cee550fefba57e839c386c3e781506570b8f2af00d

C:\Windows\ModemLogs\upfc.exe

MD5 54271049ecd01a9872797efa308a5683
SHA1 7a103af3cdc84fecf1e8610057e0bc199ddbd608
SHA256 7087ff45692728e6ec8f8e68b4a481645aeb964ac951a0a90059168153b356ed
SHA512 61f4e148259ce83ab71041dea54c56978448f5143e39de31067e4c2eace89872aa70b4c12071f344930a15d438545c62beafe5f221ac5c86134bdb1ef6e27f54

C:\Program Files (x86)\Windows NT\Accessories\System.exe

MD5 be35365662cd9d605fe6617807239ee7
SHA1 40ad063d455a823dfcc1f1c192895afcf6b43deb
SHA256 3bf575b3b7a41d712a4f324312ea042d346680d06fdd4ab2aa6f64b7ef500fa2
SHA512 080d2c458e5c0aca8f4890ac5f99083dc89642fae351c95a5f01035d20cff98890c2c934998548cc78636169e5e751a5ce5b9b2b35c66aadcbab88ffcf7a152e

memory/1040-298-0x000001CDB7AB0000-0x000001CDB7AD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sqe0fitq.j1m.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

memory/1224-411-0x00007FFF7CB10000-0x00007FFF7D5D1000-memory.dmp

memory/3476-418-0x00000000007C0000-0x0000000000AFC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 59d97011e091004eaffb9816aa0b9abd
SHA1 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512 d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3a6bad9528f8e23fb5c77fbd81fa28e8
SHA1 f127317c3bc6407f536c0f0600dcbcf1aabfba36
SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
SHA512 846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e907f77659a6601fcc408274894da2e
SHA1 9f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256 385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA512 34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

C:\Users\Admin\AppData\Local\Temp\faddd38c-ce1b-4671-9b8e-b9ebc2a9cbc2.vbs

MD5 920405a68fe967b9c82e2446ab0fd6b5
SHA1 ebc13c2d9f5c7f025597177c818380778cf40b54
SHA256 0268ab0c269df25056d89fb294825a43148b9ed4836461a0d773b77f6d0783bf
SHA512 acf02c0978595803ad3913f3a9d4b39cea96c2f8d42d8baacd1d32509352a743a979ba9a4e14bc838b7531e02b48b715d49e98f7bc9e338d83b28ea46038ffba

C:\Users\Admin\AppData\Local\Temp\e1f30b00-fc7d-457e-b424-7247b1372cc5.vbs

MD5 2b4394d36333629d50679f23b39fc490
SHA1 07ea3bd6ae02e349f39dd44f22423b3c0c47bc3a
SHA256 99672768948a9f6043f3700df24b4639e9dce05eb54ce00530e58a65fdcabcde
SHA512 48ca7e7a6fc0232c4c7db036a1e770e8e0a21f4e0bd2c31205438c8cd890e492cd555582042202f179babe9c9e5eda3014dca5276be68f91d60b1891ab67c4e1

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sysmon.exe.log

MD5 49b64127208271d8f797256057d0b006
SHA1 b99bd7e2b4e9ed24de47fb3341ea67660b84cca1
SHA256 2a5d403a2e649d8eceef8f785eeb0f6d33888ec6bbf251b3c347e34cb32b1e77
SHA512 f7c728923c893dc9bc88ad2159e0abcda41e1b40ff7e7756e6252d135ed238a2248a2662b3392449836dd1b0b580f0c866cc33e409527484fe4602e3d3f10e3e

C:\Users\Admin\AppData\Local\Temp\07ff5301-3cb1-409a-8ccd-184d8b2912dc.vbs

MD5 59b03894b9002907c200a1d10f7957c3
SHA1 569777ee08d2261f0b81c924c2dac91777ea4f1b
SHA256 2c6aec65bc2e95505a281d2f94a93ca29377a9fa1d1dd59feaeb62a57059924a
SHA512 0ab91393938f432f9facd2da76f196b3d1fbb7d81a5cb8d898f6e941fb6eabd09d47431ba805890fc4026b731cebbbb49df6636b1ff9b03a73a7650514caec46

C:\Users\Admin\AppData\Local\Temp\1005c37e-541d-4f19-a03a-bb55c4d01f46.vbs

MD5 51b873ff78e40d92791adac1bad9dcc7
SHA1 5ca65083ce58f18be3ec58637bd7d0233f697af2
SHA256 af34f882dba555ce9660d712d39ccf24a31bd98b20fb86cc659092d20f06d672
SHA512 225470ab3aed5fd7f81044f3d5532cb3fb713a213a7ebf0f066d1e97449993f21a00b6952bcfe5b99ca2ab4fab4c7581756823645294cfd22d9f7e25f18e0eb3

C:\Users\Admin\AppData\Local\Temp\aad207a3-8e95-4357-b30e-50a06a4d5c45.vbs

MD5 4f4d8fc0c5b7dd35f2c8b5eb55f245f1
SHA1 5b613d29fabac76c07950ea0a5aff714c07138fe
SHA256 0cc527021b0e526874d5a21827343c8296aac6963a346dcfd363e2f1080ff081
SHA512 8e9cb90b8b8169c579ffb9c632764edaed228698cea3ba04070a1f1cab4215c465973f821def779b9737686e92a3487b88ffdf7c11127267e161b9c46c3e097a

C:\Users\Admin\AppData\Local\Temp\69b23107-1c51-4a3a-a353-bfa1ad404d47.vbs

MD5 2813f17aa03f7d8d50b176d36c0b0146
SHA1 36e714afeca561c30102c250f206cfbbf1bac93c
SHA256 6882ce12c6821db2faa7c3d03f91322bf17892fa7d247c5903001d1695caf88c
SHA512 99d588e40c7c63dc540358c693dd486b0195a556162ef0b553195566d15f7cbd7086fb4271f9e948c426b5cc3fcf8b0821d7832f047140cb7eed02f1ab9f6cd7

C:\Users\Admin\AppData\Local\Temp\8af7815c-56d8-4e22-ad73-41edb9d735d5.vbs

MD5 424a972dd4915f5eb186d0155e8639b3
SHA1 19d0d66ed7ef5fe649cc2409d97db286b0a384be
SHA256 3af300d7edb6de5434c3c7d3e60b975438d2aaaee4590a1464e74dc51462d2b9
SHA512 b1b530af486252c375b0a568ec3fc02016dfdbec69f8f5bd2a364aead52e10654751b2e47767af1a203600976acdcf6cda878968f7c1a09a0ee660b8831cfcfa