Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 06:02
Static task
static1
Behavioral task
behavioral1
Sample
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe
-
Size
508KB
-
MD5
bb00992575aaff5993d0f56b9a70e4d0
-
SHA1
a600e4cab59b541ed1925e2ebdf329cda3172048
-
SHA256
4a83a66ee127bf43846a8c28d0cf783f70d2608b29346f9a8a1f4d069bf2c203
-
SHA512
512ac1cee999366d9548e6bdc4ea2e93866646cbeb4b7ea3ae4db2d0528f0472efcd7b567fd0e68b978285efe054dac309a703621589999f4038c93fe32014ab
-
SSDEEP
12288:mXzHLOPt7x+4K8+fVmgyDoP0F2PfIniG2/5pyO81:sKiVxV5v0YPGiD5pw
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/1612-8-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-2-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-4-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-6-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-11-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-5-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-12-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-10-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-9-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-7-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-32-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-33-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-35-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-36-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-37-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-39-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-40-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-47-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-49-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-51-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-53-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-55-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-57-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-58-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-62-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-72-0x0000000002450000-0x000000000350A000-memory.dmp upx behavioral1/memory/1612-75-0x0000000002450000-0x000000000350A000-memory.dmp upx -
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\Y: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\Z: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\E: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\I: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\N: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\O: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\W: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\L: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\M: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\R: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\U: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\V: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\X: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\H: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\J: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\K: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\P: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\S: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\G: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\Q: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened (read-only) \??\T: bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened for modification F:\autorun.inf bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Drops file in Program Files directory 5 IoCs
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7z.exe bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process File created C:\Windows\f760b18 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 20 IoCs
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exepid process 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exepid process 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Token: SeDebugPrivilege 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exepid process 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription pid process target process PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 2356 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe DllHost.exe PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE PID 1612 wrote to memory of 1064 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe taskhost.exe PID 1612 wrote to memory of 1144 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Dwm.exe PID 1612 wrote to memory of 1168 1612 bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1064
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1144
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bb00992575aaff5993d0f56b9a70e4d0_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1612
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2356
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD54f85bfa7fad1f4dfa0855a6fd62e0c96
SHA169f50fc0edf5cc98460b7b6155d1a1b703467968
SHA256de7e69c4270fffc7fecdd4532e6dabeb1ebf0ca24194c2aca1396d8dd9f528e4
SHA512a41605f2136153ddfd48c48364520813f453ba4a5d2378b38e8bb9e9bda22f07f9c67733b796f8372c9a0f58051807fda6ff235261e121c8303bd72c39793478