Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 03:46
Static task
static1
Behavioral task
behavioral1
Sample
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe
-
Size
65KB
-
MD5
a42b5fa15fa29e6d6a2e7c80cf18acd0
-
SHA1
fb32de560221765ebd943ce9eb5480c032942fa7
-
SHA256
786b77ccd5bdbe84f711c115ace59cfb0e1355878eb7b0d4f432c4e271562bcf
-
SHA512
e01cb428165c5ed4dbdb483e5a63eb3daae20186f14960dfb30bd3f033869d1ae21c76f4fa73dc07d3af7fc54d5b2d73e3ea330b4630efdd102afccff70de4a8
-
SSDEEP
1536:bjrZMluEk+LgOKOuglU78kOBdXd2ynHxu5Xh8DlyYO4flHmiG6:/lMluECt9AFkkXVHqaEN5z6
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral1/memory/2864-8-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-10-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-4-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-7-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-11-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-9-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-5-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-12-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-3-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-6-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-31-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-32-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-33-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-34-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-35-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-37-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-38-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-39-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-42-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-43-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-49-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-50-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-53-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-54-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-58-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-59-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-64-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-70-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-71-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-73-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-75-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2864-82-0x0000000000980000-0x0000000001A3A000-memory.dmp upx -
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\G: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\K: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\O: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\P: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\Q: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\S: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\M: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\R: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\U: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\V: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\X: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\Z: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\Y: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\H: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\J: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\L: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\N: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\T: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\W: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\E: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened (read-only) \??\I: a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened for modification F:\autorun.inf a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Drops file in Program Files directory 5 IoCs
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zG.exe a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7z.exe a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Drops file in Windows directory 2 IoCs
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription ioc process File created C:\Windows\f76082b a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe File opened for modification C:\Windows\SYSTEM.INI a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exepid process 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription pid process target process PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1292 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe DllHost.exe PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE PID 2864 wrote to memory of 1092 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe taskhost.exe PID 2864 wrote to memory of 1164 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Dwm.exe PID 2864 wrote to memory of 1176 2864 a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe Explorer.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1092
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a42b5fa15fa29e6d6a2e7c80cf18acd0_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2864
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1292
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\jgldc.exeFilesize
97KB
MD5e9cd3de1e96be7416f427f02df9e3a4e
SHA158f1b1e3e9322ffe9f99d2649f045998225aa6ff
SHA256d97696cece8134bd437d30ea0b0f8c70dacfe9310cd2dc02ce7d5249acc1c6fc
SHA5120687146de4089a2f90c34341fb3f343028b3116d0262d23523b291d1452f74c1870d1123554cb3be514ec4039001427bd6fbf8ef3f3b19e616987a541a088156
-
memory/1092-18-0x0000000000410000-0x0000000000412000-memory.dmpFilesize
8KB
-
memory/2864-34-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-71-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-7-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-11-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-9-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-29-0x0000000002FF0000-0x0000000002FF2000-memory.dmpFilesize
8KB
-
memory/2864-28-0x00000000038D0000-0x00000000038D1000-memory.dmpFilesize
4KB
-
memory/2864-30-0x0000000002FF0000-0x0000000002FF2000-memory.dmpFilesize
8KB
-
memory/2864-26-0x00000000038D0000-0x00000000038D1000-memory.dmpFilesize
4KB
-
memory/2864-25-0x0000000002FF0000-0x0000000002FF2000-memory.dmpFilesize
8KB
-
memory/2864-10-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-5-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-12-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-37-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-6-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-31-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-32-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-33-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-89-0x0000000002FF0000-0x0000000002FF2000-memory.dmpFilesize
8KB
-
memory/2864-4-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-3-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-38-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-39-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-42-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-43-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-49-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-50-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-53-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-54-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-58-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-59-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-64-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-70-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-35-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-73-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-75-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-82-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB
-
memory/2864-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2864-8-0x0000000000980000-0x0000000001A3A000-memory.dmpFilesize
16.7MB