Analysis
- max time kernel
22s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
21/05/2024, 08:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
19 signatures
150 seconds
General
- Target 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe
- Size 1.8MB
- Sample240521-jzbdbadh66
- SHA256 13c4cb31e54f93e0a642d03cfec51b59c1f99a735b82771e60d0c309d4fda40a
- MD5 22c3b92d4a7b00c09b9a01dc41c5484f
- SHA1 a68380980141c691745c3079b84269a7fc571a79
- SHA512 bf7fd781ca0d30849989e633a1d94ac3899b9e07014affde0140002ea001f0817230ccd61803c93620879d8eb764b1d3e723bbac6e37bbf4ae73295edac0ee51
- SSDEEP 49152:2BHTZQBIGoA5nN9615Z9VTNIeUOPI5E33uLkv4:2JZgoiN9615YeUfauYv4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ireA.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ireA.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ireA.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ireA.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ireA.exe -
resource yara_rule behavioral2/files/0x0006000000023288-8.dat aspack_v212_v242 - Deletes itself 1 IoCs
pid Process 1972 ireA.exe - Executes dropped EXE 1 IoCs
pid Process 1972 ireA.exe -
resource yara_rule behavioral2/memory/4932-1-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-4-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-17-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-22-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-21-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-23-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-11-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-10-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-34-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/4932-9-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/1972-53-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-58-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-56-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-59-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-55-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-62-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-54-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-51-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-57-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-60-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-65-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-66-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-77-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-78-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-79-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-81-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-82-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-83-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-86-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-87-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-95-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-98-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-100-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-102-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-112-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-114-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-117-0x0000000006120000-0x00000000071AE000-memory.dmp upx behavioral2/memory/1972-148-0x0000000006120000-0x00000000071AE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ireA.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ireA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ireA.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ireA.exe - Enumerates connected drives 3 TTPs 7 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: ireA.exe File opened (read-only) \??\J: ireA.exe File opened (read-only) \??\K: ireA.exe File opened (read-only) \??\L: ireA.exe File opened (read-only) \??\E: ireA.exe File opened (read-only) \??\G: ireA.exe File opened (read-only) \??\H: ireA.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe ireA.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE ireA.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe ireA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe ireA.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ireA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe ireA.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe ireA.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe ireA.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe ireA.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE ireA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe ireA.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe ireA.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe ireA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe ireA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe ireA.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe ireA.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 1972 ireA.exe 1972 ireA.exe 1972 ireA.exe 1972 ireA.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Token: SeDebugPrivilege 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe - Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 4932 wrote to memory of 1972 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 84 PID 4932 wrote to memory of 1972 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 84 PID 4932 wrote to memory of 1972 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 84 PID 4932 wrote to memory of 756 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 8 PID 4932 wrote to memory of 764 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 9 PID 4932 wrote to memory of 336 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 13 PID 4932 wrote to memory of 2912 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 50 PID 4932 wrote to memory of 2984 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 51 PID 4932 wrote to memory of 2848 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 53 PID 4932 wrote to memory of 3432 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 56 PID 4932 wrote to memory of 3576 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 57 PID 4932 wrote to memory of 3756 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 58 PID 4932 wrote to memory of 3856 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 59 PID 4932 wrote to memory of 3920 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 60 PID 4932 wrote to memory of 4004 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 61 PID 4932 wrote to memory of 3692 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 62 PID 4932 wrote to memory of 1904 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 73 PID 4932 wrote to memory of 4280 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 74 PID 4932 wrote to memory of 4172 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 81 PID 4932 wrote to memory of 2528 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 82 PID 4932 wrote to memory of 1972 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 84 PID 4932 wrote to memory of 1972 4932 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe 84 PID 1972 wrote to memory of 756 1972 ireA.exe 8 PID 1972 wrote to memory of 764 1972 ireA.exe 9 PID 1972 wrote to memory of 336 1972 ireA.exe 13 PID 1972 wrote to memory of 2912 1972 ireA.exe 50 PID 1972 wrote to memory of 2984 1972 ireA.exe 51 PID 1972 wrote to memory of 2848 1972 ireA.exe 53 PID 1972 wrote to memory of 3432 1972 ireA.exe 56 PID 1972 wrote to memory of 3576 1972 ireA.exe 57 PID 1972 wrote to memory of 3756 1972 ireA.exe 58 PID 1972 wrote to memory of 3856 1972 ireA.exe 59 PID 1972 wrote to memory of 3920 1972 ireA.exe 60 PID 1972 wrote to memory of 4004 1972 ireA.exe 61 PID 1972 wrote to memory of 3692 1972 ireA.exe 62 PID 1972 wrote to memory of 1904 1972 ireA.exe 73 PID 1972 wrote to memory of 4280 1972 ireA.exe 74 PID 1972 wrote to memory of 2528 1972 ireA.exe 82 PID 1972 wrote to memory of 5048 1972 ireA.exe 86 PID 1972 wrote to memory of 4472 1972 ireA.exe 87 PID 1972 wrote to memory of 756 1972 ireA.exe 8 PID 1972 wrote to memory of 764 1972 ireA.exe 9 PID 1972 wrote to memory of 336 1972 ireA.exe 13 PID 1972 wrote to memory of 2912 1972 ireA.exe 50 PID 1972 wrote to memory of 2984 1972 ireA.exe 51 PID 1972 wrote to memory of 2848 1972 ireA.exe 53 PID 1972 wrote to memory of 3432 1972 ireA.exe 56 PID 1972 wrote to memory of 3576 1972 ireA.exe 57 PID 1972 wrote to memory of 3756 1972 ireA.exe 58 PID 1972 wrote to memory of 3856 1972 ireA.exe 59 PID 1972 wrote to memory of 3920 1972 ireA.exe 60 PID 1972 wrote to memory of 4004 1972 ireA.exe 61 PID 1972 wrote to memory of 3692 1972 ireA.exe 62 PID 1972 wrote to memory of 1904 1972 ireA.exe 73 PID 1972 wrote to memory of 4280 1972 ireA.exe 74 PID 1972 wrote to memory of 2528 1972 ireA.exe 82 PID 1972 wrote to memory of 5048 1972 ireA.exe 86 PID 1972 wrote to memory of 4472 1972 ireA.exe 87 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ireA.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:756
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:764
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2912
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2984
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2848
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\ireA.exeC:\Users\Admin\AppData\Local\Temp\ireA.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2efb64ab.bat" "4⤵PID:228
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3576
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3856
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3692
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1904
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4280
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4172
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2528
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5048
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4472
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NCVVYLW7\k2[1].rar
- Size 4B
- SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
- MD5 d3b07384d113edec49eaa6238ad5ff00
- SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
- SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\2efb64ab.bat
- Size 183B
- SHA256 c30e6a6d7f22acd0a640c42f8114fc812863f76db681518075b2f1ba099c6a9f
- MD5 585f3ced36ac9f664c3e5e3fb54cd3ee
- SHA1 3f4e743a92ba3c75ad85ebbfe77c460cadf113fb
- SHA512 81e8d89531d729edbdf247dad4e1978ad3ed0a5e78bb61d6c5e2e3a38dab6cad2490d27ca39de2e51cca5a1d6570d416493afdf81a0888088216c48e937cbdc5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\75EE2519.exe
- Size 4B
- SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
- MD5 20879c987e2f9a916e578386d499f629
- SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
- SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\ireA.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 256B
- SHA256 a628c6206c0bf9f4b0ac6a44e8f38640cae23f3791fe80623e379d59205f594c
- MD5 ee489fa138324db5e1a94c52a9413799
- SHA1 b2e8502e3b882018c5068972fbf8d43d1684a062
- SHA512 fad2549978609b46008cf729177083cdedfd7cb7ac93555ac6b8c5576108d48c2965686e2599bb3b82c3bb1bd5dee6aa2b25b4b3355e63e68ba6811a3bb7bace
- MD5 SHA1 SHA512