Malware Analysis Report

2024-11-16 13:20

Sample ID 240519-sr5fvscg33
Target e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe
SHA256 269a7ea3b40b37add4b4c2d4336040d0bd96246294d202a43a509245af99dbac
Tags
sality backdoor evasion persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

269a7ea3b40b37add4b4c2d4336040d0bd96246294d202a43a509245af99dbac

Threat Level: Known bad

The file e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion persistence trojan upx

Modifies firewall policy service

Sality

Windows security bypass

UAC bypass

Modifies WinLogon for persistence

Modifies visiblity of hidden/system files in Explorer

Modifies Installed Components in the registry

UPX packed file

Deletes itself

Windows security modification

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Checks whether UAC is enabled

Enumerates connected drives

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-19 15:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-19 15:22

Reported

2024-05-19 15:25

Platform

win7-20240508-en

Max time kernel

23s

Max time network

119s

Command Line

"taskhost.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" \??\c:\windows\system\explorer.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\system\explorer.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc \??\c:\windows\system\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\system\explorer.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: \??\c:\windows\system\explorer.exe N/A
File opened (read-only) \??\G: \??\c:\windows\system\explorer.exe N/A
File opened (read-only) \??\I: \??\c:\windows\system\explorer.exe N/A
File opened (read-only) \??\J: \??\c:\windows\system\explorer.exe N/A
File opened (read-only) \??\K: \??\c:\windows\system\explorer.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: \??\c:\windows\system\explorer.exe N/A
File opened (read-only) \??\L: \??\c:\windows\system\explorer.exe N/A
File opened (read-only) \??\M: \??\c:\windows\system\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A
Token: SeDebugPrivilege N/A \??\c:\windows\system\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2436 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2436 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2436 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2436 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2436 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 2436 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 2436 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 2436 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 2748 wrote to memory of 2644 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2748 wrote to memory of 2644 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2748 wrote to memory of 2644 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2748 wrote to memory of 2644 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 2644 wrote to memory of 2200 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2644 wrote to memory of 2200 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2644 wrote to memory of 2200 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2644 wrote to memory of 2200 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 2200 wrote to memory of 2736 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2200 wrote to memory of 2736 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2200 wrote to memory of 2736 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2200 wrote to memory of 2736 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 2200 wrote to memory of 1944 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2200 wrote to memory of 1944 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2200 wrote to memory of 1944 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2200 wrote to memory of 1944 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 2748 wrote to memory of 1108 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\taskhost.exe
PID 2748 wrote to memory of 1172 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\Dwm.exe
PID 2748 wrote to memory of 1200 N/A \??\c:\windows\system\explorer.exe C:\Windows\Explorer.EXE
PID 2748 wrote to memory of 2200 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\svchost.exe
PID 2748 wrote to memory of 2200 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\svchost.exe
PID 2748 wrote to memory of 1108 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\taskhost.exe
PID 2748 wrote to memory of 1172 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\Dwm.exe
PID 2748 wrote to memory of 1200 N/A \??\c:\windows\system\explorer.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\system\explorer.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 15:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

N/A

Files

memory/2436-0-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2436-8-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-13-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-10-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-5-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-6-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-11-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-12-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-9-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-7-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-15-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-39-0x0000000004BE0000-0x0000000004BE2000-memory.dmp

memory/2436-41-0x0000000004BE0000-0x0000000004BE2000-memory.dmp

memory/2436-40-0x0000000005350000-0x0000000005392000-memory.dmp

memory/2436-38-0x0000000005490000-0x0000000005491000-memory.dmp

memory/2436-36-0x0000000005490000-0x0000000005491000-memory.dmp

memory/2436-35-0x0000000004BE0000-0x0000000004BE2000-memory.dmp

memory/1108-26-0x00000000020F0000-0x00000000020F2000-memory.dmp

C:\Windows\system\explorer.exe

MD5 6fcc43a59a18bc927e9a5b0203932770
SHA1 4e81e0838068410dbda3ddfa345a2853257ff752
SHA256 504d30c5909260ba04696544229fe01365edb9240516023b2cfbaba1e14e7517
SHA512 5b440e5cf09e05e86626c2940909852248f70a837374cc61e6b2fa3151ebf461de44a097b8abd9919698961854deb685a6edfe894586df94c45c3ff0d1edfb94

memory/2436-14-0x0000000002540000-0x00000000035CE000-memory.dmp

C:\Windows\system\spoolsv.exe

MD5 fef3afea3257b83f84b380fe4defec7d
SHA1 d656224abbf218df1fac1e6fff202abaf2bd5b03
SHA256 516da6adddf6f1ad40a1d1a84908c963cda3906b576e0857984556f78985eabb
SHA512 35c06c2c0a56c7370c0c0d20322b32f3cdee48e9e52880c50c6badfcde3754f7751bf5ca763b6d9e6022cb6f4fff50c8ef97bd3c201535b7de53e55e990af0a7

memory/2748-55-0x0000000002D90000-0x0000000002DD2000-memory.dmp

memory/2436-56-0x0000000002540000-0x00000000035CE000-memory.dmp

C:\Windows\system\svchost.exe

MD5 b05437c1006aaf1316b09f1a8c695755
SHA1 31c0f61e9439b46520ca8197b511fefdc24de986
SHA256 3d9da064a96eace707db4aeea4184b5908fa08ea2ccb3a0e03e0f1eae2e81b1a
SHA512 f355b1a35c5b4f3fecf15595270720acf566b40b7dcfb91fce277079d128e4354afe98b60a58d9da7d961722aa794284ffa9c7aed18ab7688cbde0e5840cb0e3

memory/2436-70-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-71-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2736-80-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2200-79-0x0000000000850000-0x0000000000892000-memory.dmp

memory/2644-87-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2436-88-0x0000000002540000-0x00000000035CE000-memory.dmp

memory/2436-104-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2736-103-0x0000000000400000-0x0000000000442000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 6e5c226c8ba2b501eb73574b7a2f5885
SHA1 f344d690d6a547c3d2ea3491365167f659543ca0
SHA256 6ab354f894c201c2a38c81c246292726acf69fb28ab4919c9110580ffdca87b5
SHA512 43a241a4274d081358f8c115b30e302ea1ec97cbf97ca4ca7f58703e9e1a53967818c5c1651d62d2d4dd11056f4f6a11963b33b1eb894ea584a624fc361e1fbc

C:\Windows\SYSTEM.INI

MD5 9fdd22ca53dd2dcf7b216912593fc4cc
SHA1 f8bf6c4209ce54014274766c5b22fb708bed8056
SHA256 c65987beb2f935dfd6e6f9acc17bf5f75efb6045481f33aecc75b06592a8178f
SHA512 1f9acddbda945c2dfd30a4a3899e241f6672bbddd4bfeb229be9a4c9155f8ce9cc518d5cbce49be9951468fc218348ac69babff23a20068a651ced9a6db5f415

memory/2748-106-0x00000000033C0000-0x000000000444E000-memory.dmp

memory/2748-111-0x00000000033C0000-0x000000000444E000-memory.dmp

memory/2748-108-0x00000000033C0000-0x000000000444E000-memory.dmp

memory/2748-110-0x00000000033C0000-0x000000000444E000-memory.dmp

memory/2748-112-0x00000000033C0000-0x000000000444E000-memory.dmp

memory/2748-124-0x0000000002450000-0x0000000002451000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-19 15:22

Reported

2024-05-19 15:24

Platform

win10v2004-20240426-en

Max time kernel

20s

Max time network

107s

Command Line

"fontdrvhost.exe"

Signatures

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" \??\c:\windows\system\explorer.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\system\svchost.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\system\explorer.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\windows\system\explorer.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\svchost.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" \??\c:\windows\system\svchost.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\spoolsv.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" \??\c:\windows\system\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" \??\c:\windows\system\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc \??\c:\windows\system\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" \??\c:\windows\system\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" \??\c:\windows\system\svchost.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\system\explorer.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: \??\c:\windows\system\explorer.exe N/A
File opened (read-only) \??\E: \??\c:\windows\system\explorer.exe N/A
File opened (read-only) \??\G: \??\c:\windows\system\explorer.exe N/A
File opened (read-only) \??\H: \??\c:\windows\system\explorer.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe \??\c:\windows\system\explorer.exe N/A
File opened for modification \??\c:\windows\system\svchost.exe \??\c:\windows\system\svchost.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\explorer.exe C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
File opened for modification \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\explorer.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\system\explorer.exe N/A
N/A N/A \??\c:\windows\system\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2988 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 2988 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 2988 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 2988 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\sihost.exe
PID 2988 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2988 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\taskhostw.exe
PID 2988 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 2988 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 2988 wrote to memory of 3824 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 2988 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 2988 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 2988 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 2988 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 2988 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 2988 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 2988 wrote to memory of 4060 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 2988 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe
PID 2988 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe
PID 2988 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2988 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 2988 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe \??\c:\windows\system\explorer.exe
PID 448 wrote to memory of 4220 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 448 wrote to memory of 4220 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 448 wrote to memory of 4220 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\spoolsv.exe
PID 4220 wrote to memory of 5048 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4220 wrote to memory of 5048 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 4220 wrote to memory of 5048 N/A \??\c:\windows\system\spoolsv.exe \??\c:\windows\system\svchost.exe
PID 5048 wrote to memory of 3984 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 5048 wrote to memory of 3984 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 5048 wrote to memory of 3984 N/A \??\c:\windows\system\svchost.exe \??\c:\windows\system\spoolsv.exe
PID 5048 wrote to memory of 952 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5048 wrote to memory of 952 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 5048 wrote to memory of 952 N/A \??\c:\windows\system\svchost.exe C:\Windows\SysWOW64\at.exe
PID 448 wrote to memory of 784 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\fontdrvhost.exe
PID 448 wrote to memory of 792 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\fontdrvhost.exe
PID 448 wrote to memory of 336 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\dwm.exe
PID 448 wrote to memory of 2500 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\sihost.exe
PID 448 wrote to memory of 2536 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\svchost.exe
PID 448 wrote to memory of 2852 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\taskhostw.exe
PID 448 wrote to memory of 3456 N/A \??\c:\windows\system\explorer.exe C:\Windows\Explorer.EXE
PID 448 wrote to memory of 3644 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\svchost.exe
PID 448 wrote to memory of 3824 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\DllHost.exe
PID 448 wrote to memory of 3952 N/A \??\c:\windows\system\explorer.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 448 wrote to memory of 4016 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe
PID 448 wrote to memory of 1044 N/A \??\c:\windows\system\explorer.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 448 wrote to memory of 3748 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe
PID 448 wrote to memory of 1948 N/A \??\c:\windows\system\explorer.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 448 wrote to memory of 4000 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe
PID 448 wrote to memory of 4060 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe
PID 448 wrote to memory of 984 N/A \??\c:\windows\system\explorer.exe C:\Windows\system32\backgroundTaskHost.exe
PID 448 wrote to memory of 5048 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\svchost.exe
PID 448 wrote to memory of 5048 N/A \??\c:\windows\system\explorer.exe \??\c:\windows\system\svchost.exe
PID 448 wrote to memory of 1216 N/A \??\c:\windows\system\explorer.exe C:\Windows\System32\RuntimeBroker.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" \??\c:\windows\system\explorer.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\e2264b6655d9f86350c14dd0a0754420_NeikiAnalytics.exe"

\??\c:\windows\system\explorer.exe

c:\windows\system\explorer.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe SE

\??\c:\windows\system\svchost.exe

c:\windows\system\svchost.exe

\??\c:\windows\system\spoolsv.exe

c:\windows\system\spoolsv.exe PR

C:\Windows\SysWOW64\at.exe

at 15:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SysWOW64\at.exe

at 15:25 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp

Files

memory/2988-0-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2988-1-0x0000000002B80000-0x0000000003C0E000-memory.dmp

memory/2988-3-0x0000000002B80000-0x0000000003C0E000-memory.dmp

memory/2988-15-0x00000000021A0000-0x00000000021A2000-memory.dmp

memory/2988-5-0x0000000002B80000-0x0000000003C0E000-memory.dmp

memory/2988-4-0x0000000002B80000-0x0000000003C0E000-memory.dmp

memory/2988-10-0x00000000021B0000-0x00000000021B1000-memory.dmp

memory/2988-9-0x00000000021A0000-0x00000000021A2000-memory.dmp

memory/2988-18-0x0000000002B80000-0x0000000003C0E000-memory.dmp

memory/2988-13-0x0000000002B80000-0x0000000003C0E000-memory.dmp

C:\Windows\System\explorer.exe

MD5 bdcc0408237b9c4fcfdf430646a519d9
SHA1 8f07e8450b028705d2c2130a1461f8dbce062c02
SHA256 41f2bdf17e9e551011a68feca1edd6a325a42853275d6ac67fc3557a2af84803
SHA512 53414186ccbfbaf532bbc2cec536749ebcc69aebe1e2933c22b58d804cff605386b9ef7b5f9db6975f562fe71e7e4b12a6f290745c9776746242911a06a6e3ab

memory/2988-14-0x0000000002B80000-0x0000000003C0E000-memory.dmp

memory/448-24-0x0000000000400000-0x0000000000442000-memory.dmp

C:\Windows\System\spoolsv.exe

MD5 1fcc8df26da691a173732e7fd9f3ea91
SHA1 37a1c4d763a182c1ca35ff304189fa149de30b86
SHA256 bb658f3adb630279b08949e40c783b2d79f67ed8121dfd0e2ebe84e4d84c7fce
SHA512 998d8d0f6416fe5e3fe00529acb77f0b970a4d8e04b9d350c7643188212abb4c5115f813cd3b14351ffb5ddda4fd193f9e89bc6aa80173e668ba0536acc1bb38

memory/2988-21-0x0000000002B80000-0x0000000003C0E000-memory.dmp

memory/2988-7-0x0000000002B80000-0x0000000003C0E000-memory.dmp

memory/2988-20-0x00000000021A0000-0x00000000021A2000-memory.dmp

memory/2988-6-0x0000000002B80000-0x0000000003C0E000-memory.dmp

memory/4220-33-0x0000000000400000-0x0000000000442000-memory.dmp

C:\Windows\System\svchost.exe

MD5 a19964adcd3754e747f86d29634606e2
SHA1 6a2638fbd50e4e9168a8b1ee9bfb0fe3f97b13e6
SHA256 e691c0421162e5b603d6cf8301b225c3b24f0ce6d4b7b187a7298cf912ff5146
SHA512 61c3f08e1d8f1a49b740cf77e2afc88cfe4faf16ed3c7662a338e7312fc13066435a8a69903953b7fa5044d57e27d7b9056d8ddeb780ecafcd55f8ae97052895

memory/3984-46-0x0000000000400000-0x0000000000442000-memory.dmp

memory/3984-50-0x0000000000400000-0x0000000000442000-memory.dmp

memory/4220-53-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2988-56-0x00000000021A0000-0x00000000021A2000-memory.dmp

memory/2988-66-0x0000000000400000-0x0000000000442000-memory.dmp

C:\Users\Admin\AppData\Roaming\mrsys.exe

MD5 ffae855a88738150b8ba883388e5c0ff
SHA1 edd77af1635ae610161a7a38d4e5f302a5737333
SHA256 7110f9fc47613d23d604e318da338257b85fbab65f3500954574b04c2a5fe6fd
SHA512 b30e075c73b4c56cf3f5b9d032c863299b68fce225ce2bb863b58b426cee391873220614a4482762bf66be59cbebc8f81bdf4a8105940a6379a7c95e8d2bd90a

memory/2988-58-0x0000000002B80000-0x0000000003C0E000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 0a5d4e3c92b0dd371e6fb84db8b504d7
SHA1 6fb4e15422fd76b1c287f7f725ae6ce7420943a4
SHA256 e27de41f600b0106d2eb0023f49bc44ba17fa0c53de1b93ea2e10382531191e4
SHA512 66c593e3c0dc4449d74fb57048104210de6fe852c1466e1d1f47b211501761cf541f7643da50e5fe8755c18c03d442f80620ee5df04a9bb051517dfffadcb2e1

memory/448-69-0x0000000003510000-0x000000000459E000-memory.dmp

memory/5048-80-0x0000000002ED0000-0x0000000002ED2000-memory.dmp

memory/448-79-0x0000000001FF0000-0x0000000001FF2000-memory.dmp

memory/448-78-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-71-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-82-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-81-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-77-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-70-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-76-0x0000000003510000-0x000000000459E000-memory.dmp

memory/5048-75-0x0000000004010000-0x0000000004011000-memory.dmp

memory/448-73-0x00000000021B0000-0x00000000021B1000-memory.dmp

memory/448-67-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-83-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-84-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-85-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-87-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-86-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-89-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-90-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-91-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-93-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-94-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-96-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-100-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-98-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-102-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-104-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-105-0x0000000003510000-0x000000000459E000-memory.dmp

memory/448-107-0x0000000003510000-0x000000000459E000-memory.dmp

C:\dmlu.exe

MD5 859b2c43074ce596fcd3c0535b5a64e2
SHA1 c48531c7b21d0083a73b12275b4eae86e6450f4c
SHA256 4fb1ec4e385b730e7302afd6bb101326bc1a7f6a209fb18f94d8c3520c8020e1
SHA512 4990a9f27434514bf75ab13bded25a04a02e729c235a51e78ff8e95eaf289ff556ea8b0ef14a6311ef7c487b7456f49c9d6955904e17c28860acfe520336f5aa