Malware Analysis Report

2024-11-16 13:20

Sample ID 240521-jzbdbadh66
Target 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics
SHA256 13c4cb31e54f93e0a642d03cfec51b59c1f99a735b82771e60d0c309d4fda40a
Tags
sality aspackv2 backdoor evasion trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

13c4cb31e54f93e0a642d03cfec51b59c1f99a735b82771e60d0c309d4fda40a

Threat Level: Known bad

The file 2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

sality aspackv2 backdoor evasion trojan upx

Modifies firewall policy service

Windows security bypass

Sality

UAC bypass

ASPack v2.12-2.42

Deletes itself

Executes dropped EXE

Loads dropped DLL

Windows security modification

UPX packed file

Checks whether UAC is enabled

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

System policy modification

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-21 08:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 08:05

Reported

2024-05-21 08:48

Platform

win7-20240220-en

Max time kernel

19s

Max time network

123s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 2184 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 2184 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 2184 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 2184 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 2184 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 2184 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 2184 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 2184 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 2184 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 2188 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\taskhost.exe
PID 2188 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\Dwm.exe
PID 2188 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\Explorer.EXE
PID 2188 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\DllHost.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\ireA.exe

C:\Users\Admin\AppData\Local\Temp\ireA.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\12a9133b.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp

Files

memory/2184-0-0x0000000000400000-0x00000000005CB000-memory.dmp

\Users\Admin\AppData\Local\Temp\ireA.exe

MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

memory/2184-21-0x00000000020F0000-0x000000000317E000-memory.dmp

memory/2184-22-0x00000000020F0000-0x000000000317E000-memory.dmp

memory/2188-40-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2188-44-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2184-43-0x00000000002D0000-0x00000000002D2000-memory.dmp

memory/2188-42-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2184-41-0x00000000002D0000-0x00000000002D2000-memory.dmp

memory/2184-36-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/2184-34-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/2184-51-0x00000000002D0000-0x00000000002D2000-memory.dmp

memory/2184-57-0x00000000020F0000-0x000000000317E000-memory.dmp

memory/2184-56-0x0000000000400000-0x00000000005CB000-memory.dmp

memory/2184-33-0x00000000002D0000-0x00000000002D2000-memory.dmp

memory/1116-25-0x00000000020B0000-0x00000000020B2000-memory.dmp

memory/2184-19-0x00000000020F0000-0x000000000317E000-memory.dmp

memory/2184-14-0x00000000020F0000-0x000000000317E000-memory.dmp

memory/2184-12-0x00000000020F0000-0x000000000317E000-memory.dmp

memory/2184-23-0x00000000020F0000-0x000000000317E000-memory.dmp

memory/2184-20-0x00000000001C0000-0x00000000001C9000-memory.dmp

memory/2184-15-0x00000000020F0000-0x000000000317E000-memory.dmp

memory/2188-18-0x0000000000E00000-0x0000000000E09000-memory.dmp

memory/2184-17-0x00000000001C0000-0x00000000001C9000-memory.dmp

memory/2184-16-0x00000000020F0000-0x000000000317E000-memory.dmp

memory/2184-13-0x00000000020F0000-0x000000000317E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

C:\Windows\SYSTEM.INI

MD5 a4d3a96d7535acb6f6b6506eec94fb70
SHA1 5587be52d150aef5e1382f62c7fbbb832aceef99
SHA256 8a5808eccb6cb25b4530e6f01b6f8c6c840ea6d8e442a2927b4bc78057ef69d5
SHA512 9875f089cc33af959097804b46e3ce29fda9491565c0bff743948c4f4b4766943a990bc680fb5b396d4e12c2f3d7ffd5aa5748419d5b5681ab24f37017233464

memory/2188-79-0x0000000000E00000-0x0000000000E09000-memory.dmp

memory/2188-70-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-76-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-77-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-75-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-73-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-86-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-72-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-78-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-74-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-80-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-90-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-89-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\565D55CF.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

memory/2188-99-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-101-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-100-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-103-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-104-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-105-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-108-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

memory/2188-128-0x0000000000260000-0x0000000000262000-memory.dmp

memory/2188-177-0x0000000004CC0000-0x0000000005D4E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\12a9133b.bat

MD5 75bad5c5877167239425557803d573e9
SHA1 98c8ae3624a1d86f6eca19ca37b3949c611c6552
SHA256 f7afa27a14e81cdb562a3e66f4c27ba8355a5ce84fe6274f4f248a517c67acdd
SHA512 507be254e6b72560e141fbfb273ac2357be438df14ee06ca83e17811a0122939f827176ee3aa6d226b243387b4ded0f8b7aaaf246718f01ed960b8e519531687

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 08:05

Reported

2024-05-21 08:48

Platform

win10v2004-20240426-en

Max time kernel

22s

Max time network

110s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4932 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 4932 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 4932 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 4932 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 4932 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 4932 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 4932 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\sihost.exe
PID 4932 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 4932 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\taskhostw.exe
PID 4932 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 4932 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 4932 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 4932 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4932 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 4932 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4932 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 4932 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4932 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 4932 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4932 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4932 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 4932 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\ireA.exe
PID 1972 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\fontdrvhost.exe
PID 1972 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\fontdrvhost.exe
PID 1972 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\dwm.exe
PID 1972 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\sihost.exe
PID 1972 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\svchost.exe
PID 1972 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\taskhostw.exe
PID 1972 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\svchost.exe
PID 1972 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\DllHost.exe
PID 1972 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1972 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\System32\RuntimeBroker.exe
PID 1972 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1972 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\System32\RuntimeBroker.exe
PID 1972 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1972 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\System32\RuntimeBroker.exe
PID 1972 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1972 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\System32\RuntimeBroker.exe
PID 1972 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\System32\RuntimeBroker.exe
PID 1972 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\fontdrvhost.exe
PID 1972 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\fontdrvhost.exe
PID 1972 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\dwm.exe
PID 1972 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\sihost.exe
PID 1972 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\svchost.exe
PID 1972 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\taskhostw.exe
PID 1972 wrote to memory of 3432 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\Explorer.EXE
PID 1972 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\svchost.exe
PID 1972 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\DllHost.exe
PID 1972 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1972 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\System32\RuntimeBroker.exe
PID 1972 wrote to memory of 4004 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1972 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\System32\RuntimeBroker.exe
PID 1972 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1972 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\System32\RuntimeBroker.exe
PID 1972 wrote to memory of 2528 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1972 wrote to memory of 5048 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\System32\RuntimeBroker.exe
PID 1972 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\ireA.exe C:\Windows\System32\RuntimeBroker.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\ireA.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\2024052022c3b92d4a7b00c09b9a01dc41c5484ficedidwapomi_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\ireA.exe

C:\Users\Admin\AppData\Local\Temp\ireA.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2efb64ab.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4932-0-0x0000000000400000-0x00000000005CB000-memory.dmp

memory/4932-1-0x00000000023D0000-0x000000000345E000-memory.dmp

memory/4932-4-0x00000000023D0000-0x000000000345E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ireA.exe

MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

memory/1972-18-0x00000000007C0000-0x00000000007C9000-memory.dmp

memory/4932-17-0x00000000023D0000-0x000000000345E000-memory.dmp

memory/4932-22-0x00000000023D0000-0x000000000345E000-memory.dmp

memory/4932-21-0x00000000023D0000-0x000000000345E000-memory.dmp

memory/4932-23-0x00000000023D0000-0x000000000345E000-memory.dmp

memory/4932-11-0x00000000023D0000-0x000000000345E000-memory.dmp

memory/4932-10-0x00000000023D0000-0x000000000345E000-memory.dmp

memory/1972-25-0x00000000030D0000-0x00000000030D2000-memory.dmp

memory/4932-24-0x00000000006B0000-0x00000000006B2000-memory.dmp

memory/1972-20-0x00000000030D0000-0x00000000030D2000-memory.dmp

memory/4932-37-0x0000000000400000-0x00000000005CB000-memory.dmp

memory/4932-34-0x00000000023D0000-0x000000000345E000-memory.dmp

memory/4932-19-0x00000000006B0000-0x00000000006B2000-memory.dmp

memory/1972-16-0x0000000003120000-0x0000000003121000-memory.dmp

memory/4932-9-0x00000000023D0000-0x000000000345E000-memory.dmp

memory/4932-14-0x0000000000C90000-0x0000000000C91000-memory.dmp

memory/4932-13-0x00000000006B0000-0x00000000006B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\75EE2519.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NCVVYLW7\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

memory/1972-53-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-58-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-56-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-59-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-55-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-62-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-54-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-61-0x00000000007C0000-0x00000000007C9000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 ee489fa138324db5e1a94c52a9413799
SHA1 b2e8502e3b882018c5068972fbf8d43d1684a062
SHA256 a628c6206c0bf9f4b0ac6a44e8f38640cae23f3791fe80623e379d59205f594c
SHA512 fad2549978609b46008cf729177083cdedfd7cb7ac93555ac6b8c5576108d48c2965686e2599bb3b82c3bb1bd5dee6aa2b25b4b3355e63e68ba6811a3bb7bace

memory/1972-51-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-57-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-60-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-65-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-66-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-77-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-78-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-79-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-81-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-82-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-83-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-86-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-87-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-95-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-98-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-100-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-102-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-112-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-114-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-116-0x00000000030D0000-0x00000000030D2000-memory.dmp

memory/1972-117-0x0000000006120000-0x00000000071AE000-memory.dmp

memory/1972-148-0x0000000006120000-0x00000000071AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2efb64ab.bat

MD5 585f3ced36ac9f664c3e5e3fb54cd3ee
SHA1 3f4e743a92ba3c75ad85ebbfe77c460cadf113fb
SHA256 c30e6a6d7f22acd0a640c42f8114fc812863f76db681518075b2f1ba099c6a9f
SHA512 81e8d89531d729edbdf247dad4e1978ad3ed0a5e78bb61d6c5e2e3a38dab6cad2490d27ca39de2e51cca5a1d6570d416493afdf81a0888088216c48e937cbdc5