Malware Analysis Report

2024-11-16 13:20

Sample ID 240521-phpr9sde22
Target 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics
SHA256 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4
Tags
sality backdoor evasion persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4

Threat Level: Known bad

The file 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics was found to be: Known bad.

Malicious Activity Summary

sality backdoor evasion persistence trojan upx

Sality

Modifies visibility of file extensions in Explorer

Windows security bypass

Modifies firewall policy service

Modifies visiblity of hidden/system files in Explorer

UAC bypass

UPX packed file

Loads dropped DLL

Executes dropped EXE

Windows security modification

Deletes itself

Adds Run key to start application

Checks whether UAC is enabled

Enumerates connected drives

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-21 12:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 12:19

Reported

2024-05-21 12:22

Platform

win7-20240419-en

Max time kernel

26s

Max time network

16s

Command Line

"taskhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2432 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 2432 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 2432 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 2432 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2784 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\taskhost.exe
PID 2784 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\Dwm.exe
PID 2784 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\taskhost.exe
PID 2784 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\Dwm.exe
PID 2784 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\Explorer.EXE
PID 2432 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\taskhost.exe
PID 2432 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\Dwm.exe
PID 2432 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 2432 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2432 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 2784 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\taskhost.exe
PID 2784 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\Dwm.exe
PID 2784 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\Explorer.EXE
PID 2784 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\taskhost.exe
PID 2784 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\Dwm.exe
PID 2784 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\Explorer.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

Network

N/A

Files

memory/2432-0-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2432-7-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-10-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-3-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-5-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-8-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-9-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-4-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-11-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-6-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-28-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-30-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2432-29-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2432-27-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2432-25-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2432-24-0x0000000000250000-0x0000000000252000-memory.dmp

memory/1088-16-0x00000000020F0000-0x00000000020F2000-memory.dmp

memory/2432-15-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-31-0x0000000002470000-0x00000000034FE000-memory.dmp

\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

MD5 d26dc22db6445c1ce36114677a5e7240
SHA1 97a7668972f7fc8c33eef6ea828b597203470085
SHA256 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4
SHA512 b21747d8d0ab194429d03118e824b061bb7619eabd45e5f687cf715b2bdb836de550019d1447cf6ac84d3e7060c5153b8d976317199f45e2280329a4313846a1

memory/2784-39-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2432-40-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-41-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-58-0x0000000000400000-0x00000000004C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0F7626E2_Rar\rundll32.exe

MD5 2eb5d76180ce7b3241b281fa79ab3483
SHA1 06293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256 e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA512 35f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b

memory/2432-46-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2784-62-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-67-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-66-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-80-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2784-81-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2784-69-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-68-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-79-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2784-64-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-63-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-65-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-60-0x00000000039B0000-0x0000000004A3E000-memory.dmp

C:\Windows\SYSTEM.INI

MD5 1ccbfdf9d28bd81836275bafde792925
SHA1 36f6c870ebf2c3710af8d2fcb32762ccba233eef
SHA256 86d0d89f9008ea9005adb3a100d4e4ce6fa5c8a1843a8e50498a3ca9d8d48a65
SHA512 b24e9337b7ed8cd064ff5e683199b0f0c6c39e629aa00aa60c8867456cd45ba7bb74e097c32081be905242eb6d2f56987322d82dd2d743a42d387fdbf1018602

memory/2784-82-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-83-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-84-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-135-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-142-0x0000000000250000-0x0000000000252000-memory.dmp

F:\pugjm.exe

MD5 8362fe6541a7fc946dd90483a1d5ef45
SHA1 be1c4fede5879a96b64730036fe2d1d162d84022
SHA256 be2f0a1b6b29c7985745a8008f23b501b0a1eae70e18e44cd9ee09c9061774d0
SHA512 24f7f70acc6e2d48847d570a30b768b9eceb3a1ca782faaa5ff47842c99210a4a384a96d0a33fa517a3bef6c11fb9a8dc3b5cb318a5d7b9e931d3fde1e6034a4

memory/2432-0-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2432-7-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-10-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-3-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-5-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-8-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-9-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-4-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-11-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-6-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-28-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-30-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2432-29-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2432-27-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2432-25-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2432-24-0x0000000000250000-0x0000000000252000-memory.dmp

memory/1088-16-0x00000000020F0000-0x00000000020F2000-memory.dmp

memory/2432-15-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-31-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2784-39-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2432-40-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-41-0x0000000002470000-0x00000000034FE000-memory.dmp

memory/2432-58-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/2432-46-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2784-62-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-67-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-66-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-80-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2784-81-0x0000000000250000-0x0000000000252000-memory.dmp

memory/2784-69-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-68-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-79-0x0000000000260000-0x0000000000261000-memory.dmp

memory/2784-64-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-63-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-65-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-60-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-82-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-83-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-84-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-135-0x00000000039B0000-0x0000000004A3E000-memory.dmp

memory/2784-142-0x0000000000250000-0x0000000000252000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 12:19

Reported

2024-05-21 12:22

Platform

win10v2004-20240508-en

Max time kernel

37s

Max time network

132s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Modifies visibility of file extensions in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\X: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1488 wrote to memory of 784 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1488 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\fontdrvhost.exe
PID 1488 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\dwm.exe
PID 1488 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\sihost.exe
PID 1488 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\taskhostw.exe
PID 1488 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\Explorer.EXE
PID 1488 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\svchost.exe
PID 1488 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\DllHost.exe
PID 1488 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 1488 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1488 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 1488 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1488 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\System32\RuntimeBroker.exe
PID 1488 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 1488 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1488 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Windows\system32\backgroundTaskHost.exe
PID 1488 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 1488 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 1488 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe
PID 4780 wrote to memory of 784 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\fontdrvhost.exe
PID 4780 wrote to memory of 792 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\fontdrvhost.exe
PID 4780 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\dwm.exe
PID 4780 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\sihost.exe
PID 4780 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\svchost.exe
PID 4780 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\taskhostw.exe
PID 4780 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\Explorer.EXE
PID 4780 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\svchost.exe
PID 4780 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\DllHost.exe
PID 4780 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4780 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\System32\RuntimeBroker.exe
PID 4780 wrote to memory of 688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4780 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\System32\RuntimeBroker.exe
PID 4780 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\System32\RuntimeBroker.exe
PID 4780 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4780 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4780 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\System32\RuntimeBroker.exe
PID 4780 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\System32\RuntimeBroker.exe
PID 4780 wrote to memory of 784 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\fontdrvhost.exe
PID 4780 wrote to memory of 792 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\fontdrvhost.exe
PID 4780 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\dwm.exe
PID 4780 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\sihost.exe
PID 4780 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\svchost.exe
PID 4780 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\taskhostw.exe
PID 4780 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\Explorer.EXE
PID 4780 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\svchost.exe
PID 4780 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\DllHost.exe
PID 4780 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4780 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\System32\RuntimeBroker.exe
PID 4780 wrote to memory of 688 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4780 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\System32\RuntimeBroker.exe
PID 4780 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\System32\RuntimeBroker.exe
PID 4780 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4780 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4780 wrote to memory of 3608 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\System32\RuntimeBroker.exe
PID 4780 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe C:\Windows\System32\RuntimeBroker.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
NL 23.62.61.113:443 www.bing.com tcp
US 8.8.8.8:53 113.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/1488-0-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/1488-1-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-11-0x0000000000970000-0x0000000000971000-memory.dmp

memory/1488-6-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-4-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-12-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-7-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-18-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/1488-16-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-10-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/1488-14-0x00000000001E0000-0x00000000001E2000-memory.dmp

memory/1488-13-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-5-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-17-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-19-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-22-0x0000000003340000-0x00000000043CE000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Office\rundll32.exe

MD5 d26dc22db6445c1ce36114677a5e7240
SHA1 97a7668972f7fc8c33eef6ea828b597203470085
SHA256 4911224219921b359aff5e4a17efd0ea02039e501a80461aafbab0fa0d2fc3f4
SHA512 b21747d8d0ab194429d03118e824b061bb7619eabd45e5f687cf715b2bdb836de550019d1447cf6ac84d3e7060c5153b8d976317199f45e2280329a4313846a1

memory/1488-24-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/1488-43-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/1488-31-0x0000000003340000-0x00000000043CE000-memory.dmp

memory/4780-28-0x0000000000400000-0x00000000004C2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0E57702F_Rar\rundll32.exe

MD5 2eb5d76180ce7b3241b281fa79ab3483
SHA1 06293dea80e39c7eb7ee2bdb00d60b58d932fa8a
SHA256 e1b9beb4617a720d55afaec364941bb18ea2c456a8b06b30a736f0cbb5c297e8
SHA512 35f553c76fc67afb88a6a090fcbad6af3e2faae154c9c84bd869714194012525a2d42b76dad855805f107a37c351f0de08fd9a03d8ddc1dd400d64640d81b90b

C:\Windows\SYSTEM.INI

MD5 73605b1f9efbe4e3bac20310aaa90f87
SHA1 ed1306656a6f65e7415573edfd24a021e079e986
SHA256 3a3dec01284be9f38bd8cb5aa316ff4e3623cdca5b425f94680859aed2b58cab
SHA512 afba86d9ababd4fd99d2bba08928cccf2941205b7f668d79b0fd05d22dee0a0653affde8a344322b8475212e525d82e565eaae51f8ce4035eaa4efd42373f4c2

memory/4780-50-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-53-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-55-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-57-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-54-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-51-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-49-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-47-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-60-0x0000000002FF0000-0x0000000002FF2000-memory.dmp

memory/4780-59-0x0000000003090000-0x0000000003091000-memory.dmp

memory/4780-52-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-56-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-61-0x0000000002FF0000-0x0000000002FF2000-memory.dmp

memory/4780-62-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-63-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-66-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-67-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-68-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-70-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-71-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-72-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-74-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-75-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-77-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-78-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-80-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-84-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-90-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-91-0x0000000004F10000-0x0000000005F9E000-memory.dmp

C:\ghmpn.pif

MD5 4bb030bd6aa85d70a2035b464f57bbd1
SHA1 13ba9237c76f8f9158364ace8ca0d87edd8d7814
SHA256 2ba7808aaf74387949f05da2d1a056d9ee416e37419879818c2c1a8d3fb8b995
SHA512 729c114834d0e912a2395ce87baa1add90e87df5a4bf323d8fe5f2e5695fb441a59c0ffdb199d6887f3c43e71a7b7663dd769b6d1347e740612d955c48b41b36

memory/4780-126-0x0000000004F10000-0x0000000005F9E000-memory.dmp

memory/4780-127-0x0000000002FF0000-0x0000000002FF2000-memory.dmp

memory/4780-143-0x0000000000400000-0x00000000004C2000-memory.dmp

memory/4780-144-0x0000000004F10000-0x0000000005F9E000-memory.dmp