Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/05/2024, 19:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe
-
Size
5.5MB
-
MD5
218766a42d60756b11de22d5f6a8ae10
-
SHA1
c607c71caa674a1efe47537460b775fa64496f09
-
SHA256
d257dae62ad6ad306b0627d4f72440659189146f6cbe044e2e0cac67017944a5
-
SHA512
9900550a64dd030b3bc8910975f18213f8ed9b0ba6cb8e9ab6f3d8d2e9687961f086570be3a79a7770ab8833f4cbb49284088efb12ec11d30024a26a7a3a6a08
-
SSDEEP
98304:oseHlHdc5b9dXLVi2xIb7S1fw7pXyZ7oz0R5uz0rbJagkW7kOLIx1qxz8hjFrZBv:Bem17h10XvwPhagz7q2wNPQ00w
Score
8/10
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\debugger = "ntsd -d" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\debugger = "ntsd -d" reg.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe " cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\regedit.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\misc.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Journal\PDIALOG.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows NT\Accessories\wordpad.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Windows Media Player\WMPDMC.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmplayer.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\javaw.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ssvagent.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Hearts\Hearts.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\DVD Maker\DVDMaker.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Chess\Chess.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\ktab.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\orbd.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\java.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jre7\bin\servertool.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Defender\MSASCui.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmlaunch.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\ink\mip.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Program Files\Microsoft Games\FreeCell\FreeCell.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\twunk_32.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\winhlp32.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\Boot\PCAT\memtest.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\bfsvc.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\explorer.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\HelpPane.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\splwow64.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\write.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\fveupdate.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\hh.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\notepad.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe File opened for modification \??\c:\Windows\twunk_16.exe 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe " cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt \ = " exefile" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jpgfile\Shell\Open\Command cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe " cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zipfile\Shell\Open\Command cmd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2344 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 2344 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 2344 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 2344 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 28 PID 3024 wrote to memory of 1700 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 30 PID 3024 wrote to memory of 1700 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 30 PID 3024 wrote to memory of 1700 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 30 PID 3024 wrote to memory of 1700 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 30 PID 3024 wrote to memory of 1644 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 31 PID 3024 wrote to memory of 1644 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 31 PID 3024 wrote to memory of 1644 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 31 PID 3024 wrote to memory of 1644 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 31 PID 3024 wrote to memory of 1664 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 33 PID 3024 wrote to memory of 1664 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 33 PID 3024 wrote to memory of 1664 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 33 PID 3024 wrote to memory of 1664 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 33 PID 3024 wrote to memory of 1544 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 36 PID 3024 wrote to memory of 1544 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 36 PID 3024 wrote to memory of 1544 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 36 PID 3024 wrote to memory of 1544 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 36 PID 3024 wrote to memory of 1048 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 38 PID 3024 wrote to memory of 1048 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 38 PID 3024 wrote to memory of 1048 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 38 PID 3024 wrote to memory of 1048 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 38 PID 3024 wrote to memory of 544 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 39 PID 3024 wrote to memory of 544 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 39 PID 3024 wrote to memory of 544 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 39 PID 3024 wrote to memory of 544 3024 218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe 39 PID 1700 wrote to memory of 764 1700 cmd.exe 42 PID 1700 wrote to memory of 764 1700 cmd.exe 42 PID 1700 wrote to memory of 764 1700 cmd.exe 42 PID 1700 wrote to memory of 764 1700 cmd.exe 42 PID 1700 wrote to memory of 908 1700 cmd.exe 43 PID 1700 wrote to memory of 908 1700 cmd.exe 43 PID 1700 wrote to memory of 908 1700 cmd.exe 43 PID 1700 wrote to memory of 908 1700 cmd.exe 43 PID 1700 wrote to memory of 920 1700 cmd.exe 44 PID 1700 wrote to memory of 920 1700 cmd.exe 44 PID 1700 wrote to memory of 920 1700 cmd.exe 44 PID 1700 wrote to memory of 920 1700 cmd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.execmd.exe2⤵PID:2344
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\123.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:764
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:908
-
-
C:\Windows\SysWOW64\reg.exereg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f3⤵
- Sets file execution options in registry
PID:920
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c assoc .txt = exefile2⤵
- Modifies registry class
PID:1644
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype comfile=C:\Users\Admin\AppData\Local\Temp\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe2⤵
- Modifies system executable filetype association
- Modifies registry class
PID:1664
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype zipfile=C:\Users\Admin\AppData\Local\Temp\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1544
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype jpgfile=C:\Users\Admin\AppData\Local\Temp\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:1048
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ftype txtfile=C:\Users\Admin\AppData\Local\Temp\218766a42d60756b11de22d5f6a8ae10_NeikiAnalytics.exe2⤵
- Modifies registry class
PID:544
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
443B
MD570170ba16a737a438223b88279dc6c85
SHA1cc066efa0fca9bc9f44013660dea6b28ddfd6a24
SHA256d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a
SHA51237cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da
-
Filesize
5.5MB
MD593e996bd6005dae0aecc8a30222bb405
SHA140067eb28a64daba3fe2f95506844f6f259c393c
SHA256e47dedfb9cde3d592abc6246f93d00fd81e5efbaa4beed5e2ce1d7d9e8f675b5
SHA512fa159e2af9784a9c3a3358be3c46b983cff7c145a3c8d43c5cab3c73dc86e5e5cf3570a3e38fe62ba302110121f92f31be26e5939b63ad9e4ef616a3a4275dc8