Analysis
-
max time kernel
122s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 03:08
Static task
static1
Behavioral task
behavioral1
Sample
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe
-
Size
65KB
-
MD5
7e588d0ce6c87385d5c35c044c799a00
-
SHA1
8c5c7e0dee9bea69e76dbd54c66e226a5eb7f46c
-
SHA256
a7250653d0d1201d13bbc2505f113638c16c90bd3919dd91b2046d0f07f6ec4f
-
SHA512
85504af2f7bcc21b443d0e401b655175b0ecc5ff434f6dcf98ac5be091536c5f4fe3753a0fb35ddadd8b95cfa8124722e1764a0518eb29613271ede82091b9ab
-
SSDEEP
1536:Dds8cYMwBssBIjMTQmceUeApa5wKnrkKFQshX5hyTP:DDJh1IosmceU6rkpshXMP
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/2136-10-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-8-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-5-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-4-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-1-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-17-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-19-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-21-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-9-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-18-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-22-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-23-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-24-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-25-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-26-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-28-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-29-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-30-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-32-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-33-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-35-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-36-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-38-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-41-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-45-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-47-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-53-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-55-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-56-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-59-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-60-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-63-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-64-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-67-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-68-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-71-0x0000000000860000-0x000000000191A000-memory.dmp upx behavioral2/memory/2136-72-0x0000000000860000-0x000000000191A000-memory.dmp upx -
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\Q: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\V: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\O: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\U: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\Z: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\L: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\M: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\N: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\W: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\Y: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\H: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\K: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\R: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\J: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\P: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\S: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\T: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\X: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\E: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\G: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened (read-only) \??\I: 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification F:\autorun.inf 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Drops file in Program Files directory 12 IoCs
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zG.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process File created C:\Windows\e575e7b 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exepid process 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Token: SeDebugPrivilege 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription pid process target process PID 2136 wrote to memory of 784 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe fontdrvhost.exe PID 2136 wrote to memory of 792 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe fontdrvhost.exe PID 2136 wrote to memory of 388 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe dwm.exe PID 2136 wrote to memory of 2452 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe sihost.exe PID 2136 wrote to memory of 2464 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe svchost.exe PID 2136 wrote to memory of 2632 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe taskhostw.exe PID 2136 wrote to memory of 3388 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Explorer.EXE PID 2136 wrote to memory of 3596 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe svchost.exe PID 2136 wrote to memory of 3852 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe DllHost.exe PID 2136 wrote to memory of 3992 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 2136 wrote to memory of 4056 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 2676 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe SearchApp.exe PID 2136 wrote to memory of 4140 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 4456 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 804 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe TextInputHost.exe PID 2136 wrote to memory of 4316 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe backgroundTaskHost.exe PID 2136 wrote to memory of 784 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe fontdrvhost.exe PID 2136 wrote to memory of 792 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe fontdrvhost.exe PID 2136 wrote to memory of 388 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe dwm.exe PID 2136 wrote to memory of 2452 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe sihost.exe PID 2136 wrote to memory of 2464 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe svchost.exe PID 2136 wrote to memory of 2632 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe taskhostw.exe PID 2136 wrote to memory of 3388 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Explorer.EXE PID 2136 wrote to memory of 3596 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe svchost.exe PID 2136 wrote to memory of 3852 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe DllHost.exe PID 2136 wrote to memory of 3992 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 2136 wrote to memory of 4056 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 2676 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe SearchApp.exe PID 2136 wrote to memory of 4140 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 4456 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 804 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe TextInputHost.exe PID 2136 wrote to memory of 4316 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe backgroundTaskHost.exe PID 2136 wrote to memory of 784 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe fontdrvhost.exe PID 2136 wrote to memory of 792 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe fontdrvhost.exe PID 2136 wrote to memory of 388 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe dwm.exe PID 2136 wrote to memory of 2452 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe sihost.exe PID 2136 wrote to memory of 2464 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe svchost.exe PID 2136 wrote to memory of 2632 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe taskhostw.exe PID 2136 wrote to memory of 3388 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Explorer.EXE PID 2136 wrote to memory of 3596 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe svchost.exe PID 2136 wrote to memory of 3852 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe DllHost.exe PID 2136 wrote to memory of 3992 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 2136 wrote to memory of 4056 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 2676 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe SearchApp.exe PID 2136 wrote to memory of 4140 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 4456 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 804 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe TextInputHost.exe PID 2136 wrote to memory of 4316 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe backgroundTaskHost.exe PID 2136 wrote to memory of 784 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe fontdrvhost.exe PID 2136 wrote to memory of 792 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe fontdrvhost.exe PID 2136 wrote to memory of 388 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe dwm.exe PID 2136 wrote to memory of 2452 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe sihost.exe PID 2136 wrote to memory of 2464 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe svchost.exe PID 2136 wrote to memory of 2632 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe taskhostw.exe PID 2136 wrote to memory of 3388 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe Explorer.EXE PID 2136 wrote to memory of 3596 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe svchost.exe PID 2136 wrote to memory of 3852 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe DllHost.exe PID 2136 wrote to memory of 3992 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 2136 wrote to memory of 4056 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 2676 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe SearchApp.exe PID 2136 wrote to memory of 4140 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 4456 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe RuntimeBroker.exe PID 2136 wrote to memory of 804 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe TextInputHost.exe PID 2136 wrote to memory of 4316 2136 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe backgroundTaskHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:388
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2464
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2632
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7e588d0ce6c87385d5c35c044c799a00_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3852
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3992
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4056
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2676
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4140
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4456
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:804
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4316
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\wdux.pifFilesize
97KB
MD5dd0a37d9f40c562a2c0e142fd964a1fe
SHA16f7059f6990ba870db77f39cd148024ac7bc4883
SHA256fa1e23712fd8eb8a012ca1bb01201da2e215050af8ef91902b1c923b4535680b
SHA51205ec0b3d6570aca52bd43b0daf76bb362bebc001a4ffdb7c35f64df9421d35c565bda57b024add22bdc6edcfec3e6e5c9e888a49d1697f32f19447fd892ebc91
-
memory/2136-30-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-4-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-5-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2136-7-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2136-6-0x0000000000640000-0x0000000000642000-memory.dmpFilesize
8KB
-
memory/2136-1-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-11-0x0000000000640000-0x0000000000642000-memory.dmpFilesize
8KB
-
memory/2136-17-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-19-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-21-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-9-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-20-0x0000000000640000-0x0000000000642000-memory.dmpFilesize
8KB
-
memory/2136-18-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-22-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-32-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-24-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-25-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-26-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-28-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-78-0x0000000000640000-0x0000000000642000-memory.dmpFilesize
8KB
-
memory/2136-8-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-23-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-33-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-35-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-36-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-38-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-41-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-45-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-47-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-53-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-55-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-56-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-59-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-60-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-63-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-64-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-67-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-68-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-71-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-72-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-29-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB
-
memory/2136-10-0x0000000000860000-0x000000000191A000-memory.dmpFilesize
16.7MB