Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 05:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe
-
Size
786KB
-
MD5
b4e7ed81054fc59cb683727ddf5c7700
-
SHA1
fc1c4f6bba631951ea0f7e4c58fbdf352d749f19
-
SHA256
7bf4ea67a4744def1c430e7fef939a1bd548da3f5b89de05b4721dc7ec3cacf7
-
SHA512
220daf7668209d5ba3121986d1ef85f318bf51b5a59802b9531f94ca30e3fae068a5242d0eab411209e174a3132c82a15c68278762957fdb3c6b42f2b58c8e3e
-
SSDEEP
12288:uwKfOVRo9yRYiQ7E4O8b8ITDnlOB1ZhIRPA0:uxWVeyRYiQ7E4O8b8ITDnlO30
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe" b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftOneDriveSetup26962 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe" b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\es\OperatingOperating.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\es\RCX6572.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe -
Drops file in Program Files directory 42 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wowhelperRuntime4.1.2.0.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX681F.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\WindowsWindows10.0.19041.1.160101.0800.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\RCX4A21.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\RCX3FFC.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\MicrosoftVisual.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\RCX5F83.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\textadoberfp.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX36A1.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\RCX36B2.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\textadoberfp.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\ManagerReader.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\UpdaterEscript.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\ManagerReader.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wowhelperRuntime4.1.2.0.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX685F.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\StudioMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\Launcherjava.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\RCX5359.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\NPPDF32Adobe.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\RCX5F44.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX70FB.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX4953.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\RCX49A3.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\RCX3FDC.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\StudioMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\RCX5E39.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\NPPDF32Acrobat.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\WindowsWindows10.0.19041.1.160101.0800.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\importedtype.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\VisualStudioStudio.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX5484.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\AdobeCreate19.10.20064.310990.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VC\StudioMSDIA100.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VC\RCX3F6D.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\BrowserControl.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX5389.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\AdobeCreate19.10.20064.310990.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AdobeAiod19.8.20071.303822.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AdobeAiod.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\RCX3633.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_93484\Launcherjava.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ativehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_3edcb155b3075f9d\sdiagnhostWindows.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\IME\IMEJP\DICTS\MSHWJPNRSystem.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..w-devenum.resources_31bf3856ad364e35_10.0.19041.1_es-es_5159ca1e760f37c0\Sistemaoperativo.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofmt.resources_31bf3856ad364e35_10.0.19041.1_it-it_cad9e428985df611\AUTOFMTWindows10.0.19041.1.160101.0800.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..latform-updateagent_31bf3856ad364e35_10.0.19041.1202_none_88bcd07abea9b666\UpdateAgentWindows10.0.19041.12023.2108251806.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasbase-rasl2tp_31bf3856ad364e35_10.0.19041.488_none_77ac529b46dc3a08\rasl2tpMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_dual_vrd.inf_31bf3856ad364e35_10.0.19041.1_none_7192107971b1a0eb\SystemMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\Boot\EFI\en-US\bootmgrmemdiag.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\IME\IMETC\DICTS\MicrosoftWindows.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-embeddedmodeclient_31bf3856ad364e35_10.0.19041.746_none_455e98024cdcc8d5\Windowsembeddedmodesvcapi.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fdbth_31bf3856ad364e35_10.0.19041.1_none_094337b8d36e2657\WindowsOperating10.0.19041.1.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_multipoint-perfcounters-files.resources_31bf3856ad364e35_10.0.19041.1_de-de_f0f8ce508ac7c59a\WindowsBetriebssystem.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..collector.resources_31bf3856ad364e35_10.0.19041.1_de-de_cc4c7bce0ade5d8f\Windowswecsvc.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ssettings.resources_31bf3856ad364e35_10.0.19041.1_it-it_8bc81a769e7f7d21\SistemaWindows.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\1036\alinkuivbc7ui.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\IME\en-US\RCXFF08.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..one-updater-service_31bf3856ad364e35_10.0.19041.746_none_aa001662f935a5b0\OperatingMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-onecore-t..ngservice.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_c870f855e8642507\TetheringServiceWindows.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.v4.0.Framework\v4.0_10.0.0.0__b03f5f7f11d50a3a\VisualOffice.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\Branding\Basebrd\RCX457B.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ation-net.resources_31bf3856ad364e35_10.0.19041.1_it-it_d5c776ffef77baa1\WindowsMicrosoft10.0.19041.1.160101.0800.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ipmiprovider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_dedac9629cf98f96\Windowsdexploitation.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\ToolsStudio.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\msil_microsoft.powershel..anagement.resources_31bf3856ad364e35_1.0.0.0_ja-jp_01fb500ab71c0c1d\Windowsresources.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\SystemMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\SystemMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\Boot\PCAT\en-GB\bootmgrSystem.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_windows-id-connecte..-provider-tokenprov_31bf3856ad364e35_10.0.19041.1_none_8fda99814fc8ff3f\MicrosoftOperating.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_system.net.nameresolution_b03f5f7f11d50a3a_4.0.15805.0_none_95901a4060e565ee\SystemMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine-dui_31bf3856ad364e35_10.0.19041.746_none_bed47145622fd035\SystemMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\RCXB1EF.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\Microsoftresources.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\RCXB200.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\Branding\Basebrd\MicrosoftSystem.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-identitystore_31bf3856ad364e35_10.0.19041.746_none_1fbd618700a52b5f\IdStoreWindows10.0.19041.746.160101.0800.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-http_31bf3856ad364e35_10.0.19041.264_none_d83f503a0f0af1e3\HttpWindows.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\RCX1D1C.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.v4.0.Framework\v4.0_10.0.0.0__b03f5f7f11d50a3a\RCX6592.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\de\resourcesMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\Boot\EFI\hu-HU\opercismemdiag.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\RCXDE.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cdp.resources_31bf3856ad364e35_10.0.19041.1_es-es_b461d43bf11d05b6\Windowsoperativo.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_11.0.19041.1_de-de_9f3ce810d6247c9e\jscriptMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..ocess-mui.resources_31bf3856ad364e35_10.0.19041.1_de-de_5f0eae6f31cf760f\Betriebssystemxwizard.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ado15-rll.resources_31bf3856ad364e35_10.0.19041.1_en-us_1d215b865d4f87af\OperatingSystem10.0.19041.1.160101.0800.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..gssystems.resources_31bf3856ad364e35_10.0.19041.1_it-it_9e9d626e42831e97\pcbpvalidit.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\x86_microsoft-windows-t..cognition.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_da340e87003217e1\mshwLatinmshwLatin10.0.19041.1.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\de\RCXFF28.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\AppVresources10.0.19041.1.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1_none_f725ad3465e95fe3\Microsoftklist.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1_pt-br_be386c4fe997180a\MicrosoftCOMCTL3210.0.19041.1.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usbceip.resources_31bf3856ad364e35_10.0.19041.1_en-us_51d80c3eb9b344c5\WindowsMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..asconsent.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fde6a08bf03c8f09\EASConsentMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_16a30fa92fe5e343\WindowsOperating.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wbiosrvc.resources_31bf3856ad364e35_10.0.19041.1_es-es_a14c0baecf9e5ae2\wbiosrvcSistema.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\msil_caspol.resources_b03f5f7f11d50a3a_10.0.19041.1_fr-fr_9c1f5e1b9556de7e\CasPolMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\IME\en-US\SystemMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.v9.0\9.0.0.0__b03f5f7f11d50a3a\RCX1C5F.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ionengine.resources_31bf3856ad364e35_10.0.19041.1_en-us_d3389638e6fd95a2\MigResmigres.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\IME\IMEJP\DICTS\RCX455B.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File opened for modification C:\Windows\IME\IMETC\DICTS\RCX45BA.tmp b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..fications.resources_31bf3856ad364e35_10.0.19041.1_it-it_fe1cb1b1724c83cf\Sistemaoperativo.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devices-lowlevel-winrt_31bf3856ad364e35_10.0.19041.264_none_12a7603dd0f94c98\SystemMicrosoft.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.19041.1_it-it_4518c9a6348a0867\operativoApphelp.exe b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe 920 b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b4e7ed81054fc59cb683727ddf5c7700_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\RCX4A21.tmp
Filesize787KB
MD59541d5cab6a79c692ef18f69b3d3fca5
SHA15c7cc70f2bb1ca80064d8330bff08efa6bf1fb4e
SHA256c7b8e2d3fa32ec9c7c2183205840648c29163476df9d445728a377212f6690ed
SHA512e569c6c1e331e2bcd9651b44107aa9e5571ef88f5292f4ae0419fdb3b3395dd8b490182d053ca832d2b70d2b06818844c81e9e342349840d2901985c4fb502e9
-
Filesize
787KB
MD5ffc5b3ddc1138c7d08539c61fd5111af
SHA1732ca67d74ff6b4fc4e0cd9e739b6acdc175df22
SHA256fc8528d7335204c0134ca1f6f1d02c31a2abd9b32acfcc94025ac5a7324f7daf
SHA5128c5064c7e6a84a3c9a6339638065c58e8e46ac89ee701eb6a33eac7aaf4c13cba8cf7e735ae261298f8dbb05303021453b115e545c0b6b2097759c4b1a7126f8
-
Filesize
786KB
MD5b4e7ed81054fc59cb683727ddf5c7700
SHA1fc1c4f6bba631951ea0f7e4c58fbdf352d749f19
SHA2567bf4ea67a4744def1c430e7fef939a1bd548da3f5b89de05b4721dc7ec3cacf7
SHA512220daf7668209d5ba3121986d1ef85f318bf51b5a59802b9531f94ca30e3fae068a5242d0eab411209e174a3132c82a15c68278762957fdb3c6b42f2b58c8e3e