Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 13:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
13 signatures
150 seconds
General
- Target ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe
- Size 65KB
- Sample240519-qshmdaad73
- SHA256 889a59e2cca36d2b5547520749c9c8a09351b944a97f5ddd75aa2eee8537e4b9
- MD5 ca5c31ac97fef4c6142e866cce84de10
- SHA1 d60be2808f3b3f64b314fd8c2d1a1d963afc17dd
- SHA512 035036d7dc3e2774939f3417d01ea717357af3251d59730009738414b6bdcc9aa7e08ddabe5f5436abf7565ef40af6aa928176527b2525997b70e510fc2d421d
- SSDEEP 1536:Wz8fRNuY7UcBWmUJgt7ZxbzJh0f7ICdonks:/2KWbmt1xBuICOb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe -
resource yara_rule behavioral2/memory/760-8-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-1-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-9-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-18-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-10-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-19-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-6-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-7-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-3-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-4-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-21-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-22-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-23-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-24-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-25-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-27-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-28-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-29-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-31-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-32-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-34-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-35-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-38-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-40-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-43-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-46-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-47-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-48-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-49-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-50-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-52-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-59-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/760-61-0x0000000000790000-0x000000000184A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe - Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\O: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\Q: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\H: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\M: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\N: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\S: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\G: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\I: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\J: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\K: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\L: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\P: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\R: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened (read-only) \??\T: ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe File created C:\Windows\e5737c9 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe Token: SeDebugPrivilege 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 760 wrote to memory of 780 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 8 PID 760 wrote to memory of 788 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 9 PID 760 wrote to memory of 316 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 13 PID 760 wrote to memory of 2624 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 44 PID 760 wrote to memory of 2632 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 45 PID 760 wrote to memory of 2764 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 48 PID 760 wrote to memory of 3556 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 56 PID 760 wrote to memory of 3688 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 57 PID 760 wrote to memory of 3864 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 58 PID 760 wrote to memory of 3960 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 59 PID 760 wrote to memory of 4020 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 60 PID 760 wrote to memory of 3128 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 61 PID 760 wrote to memory of 4168 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 62 PID 760 wrote to memory of 812 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 74 PID 760 wrote to memory of 2912 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 75 PID 760 wrote to memory of 4928 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 80 PID 760 wrote to memory of 3312 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 81 PID 760 wrote to memory of 780 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 8 PID 760 wrote to memory of 788 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 9 PID 760 wrote to memory of 316 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 13 PID 760 wrote to memory of 2624 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 44 PID 760 wrote to memory of 2632 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 45 PID 760 wrote to memory of 2764 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 48 PID 760 wrote to memory of 3556 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 56 PID 760 wrote to memory of 3688 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 57 PID 760 wrote to memory of 3864 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 58 PID 760 wrote to memory of 3960 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 59 PID 760 wrote to memory of 4020 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 60 PID 760 wrote to memory of 3128 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 61 PID 760 wrote to memory of 4168 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 62 PID 760 wrote to memory of 812 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 74 PID 760 wrote to memory of 2912 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 75 PID 760 wrote to memory of 3312 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 81 PID 760 wrote to memory of 3040 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 84 PID 760 wrote to memory of 4772 760 ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe 85 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2632
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2764
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ca5c31ac97fef4c6142e866cce84de10_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:760
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3688
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3864
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3960
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4020
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3128
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4168
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:812
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2912
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4928
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:3312
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3040
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4772
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5