6978cca5313d7108e115c9c31bc11b0649ab159b8c6dbf48790bf0e9221dfd5f

Processes:

522180e84817741a0c25656cf714d660_NeikiAnalytics.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

Processes:

522180e84817741a0c25656cf714d660_NeikiAnalytics.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

WScript.exeWScript.exeWScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\BVRKIPTS = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\BVRKIPTS = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\BVRKIPTS = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.execmd.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

Processes:

avscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid process

4968 avscan.exe
2440 avscan.exe
4428 hosts.exe
740 hosts.exe
368 avscan.exe
1672 hosts.exe

pid	process
4968	avscan.exe
2440	avscan.exe
4428	hosts.exe
740	hosts.exe
368	avscan.exe
1672	hosts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

522180e84817741a0c25656cf714d660_NeikiAnalytics.exeavscan.exehosts.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe

Drops file in Windows directory 5 IoCs

Processes:

avscan.exehosts.exe522180e84817741a0c25656cf714d660_NeikiAnalytics.exe

description	ioc	process
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe
File created	\??\c:\windows\W_X_C.bat	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe
File opened for modification	C:\Windows\hosts.exe	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

522180e84817741a0c25656cf714d660_NeikiAnalytics.execmd.execmd.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

pid process

2952 REG.exe
2360 REG.exe
3604 REG.exe
2624 REG.exe
4500 REG.exe
1204 REG.exe
1068 REG.exe
5024 REG.exe
2932 REG.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

avscan.exehosts.exe

pid process

4968 avscan.exe
4428 hosts.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

522180e84817741a0c25656cf714d660_NeikiAnalytics.exeavscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid process

3352 522180e84817741a0c25656cf714d660_NeikiAnalytics.exe
4968 avscan.exe
2440 avscan.exe
4428 hosts.exe
740 hosts.exe
368 avscan.exe
1672 hosts.exe

pid	process
2952	REG.exe
2360	REG.exe
3604	REG.exe
2624	REG.exe
4500	REG.exe
1204	REG.exe
1068	REG.exe
5024	REG.exe
2932	REG.exe

pid	process
4968	avscan.exe
4428	hosts.exe

pid	process
3352	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe
4968	avscan.exe
2440	avscan.exe
4428	hosts.exe
740	hosts.exe
368	avscan.exe
1672	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

522180e84817741a0c25656cf714d660_NeikiAnalytics.exeavscan.execmd.execmd.exehosts.execmd.exe

description	pid	process	target process
PID 3352 wrote to memory of 1068	3352	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe	REG.exe
PID 3352 wrote to memory of 1068	3352	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe	REG.exe
PID 3352 wrote to memory of 1068	3352	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe	REG.exe
PID 3352 wrote to memory of 4968	3352	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe	avscan.exe
PID 3352 wrote to memory of 4968	3352	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe	avscan.exe
PID 3352 wrote to memory of 4968	3352	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe	avscan.exe
PID 4968 wrote to memory of 2440	4968	avscan.exe	avscan.exe
PID 4968 wrote to memory of 2440	4968	avscan.exe	avscan.exe
PID 4968 wrote to memory of 2440	4968	avscan.exe	avscan.exe
PID 4968 wrote to memory of 4216	4968	avscan.exe	cmd.exe
PID 4968 wrote to memory of 4216	4968	avscan.exe	cmd.exe
PID 4968 wrote to memory of 4216	4968	avscan.exe	cmd.exe
PID 3352 wrote to memory of 4588	3352	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe	cmd.exe
PID 3352 wrote to memory of 4588	3352	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe	cmd.exe
PID 3352 wrote to memory of 4588	3352	522180e84817741a0c25656cf714d660_NeikiAnalytics.exe	cmd.exe
PID 4216 wrote to memory of 4428	4216	cmd.exe	hosts.exe
PID 4216 wrote to memory of 4428	4216	cmd.exe	hosts.exe
PID 4216 wrote to memory of 4428	4216	cmd.exe	hosts.exe
PID 4588 wrote to memory of 740	4588	cmd.exe	hosts.exe
PID 4588 wrote to memory of 740	4588	cmd.exe	hosts.exe
PID 4588 wrote to memory of 740	4588	cmd.exe	hosts.exe
PID 4428 wrote to memory of 368	4428	hosts.exe	avscan.exe
PID 4428 wrote to memory of 368	4428	hosts.exe	avscan.exe
PID 4428 wrote to memory of 368	4428	hosts.exe	avscan.exe
PID 4216 wrote to memory of 4740	4216	cmd.exe	WScript.exe
PID 4216 wrote to memory of 4740	4216	cmd.exe	WScript.exe
PID 4216 wrote to memory of 4740	4216	cmd.exe	WScript.exe
PID 4588 wrote to memory of 4596	4588	cmd.exe	WScript.exe
PID 4588 wrote to memory of 4596	4588	cmd.exe	WScript.exe
PID 4588 wrote to memory of 4596	4588	cmd.exe	WScript.exe
PID 4428 wrote to memory of 4868	4428	hosts.exe	cmd.exe
PID 4428 wrote to memory of 4868	4428	hosts.exe	cmd.exe
PID 4428 wrote to memory of 4868	4428	hosts.exe	cmd.exe
PID 4868 wrote to memory of 1672	4868	cmd.exe	hosts.exe
PID 4868 wrote to memory of 1672	4868	cmd.exe	hosts.exe
PID 4868 wrote to memory of 1672	4868	cmd.exe	hosts.exe
PID 4868 wrote to memory of 1956	4868	cmd.exe	WScript.exe
PID 4868 wrote to memory of 1956	4868	cmd.exe	WScript.exe
PID 4868 wrote to memory of 1956	4868	cmd.exe	WScript.exe
PID 4968 wrote to memory of 5024	4968	avscan.exe	REG.exe
PID 4968 wrote to memory of 5024	4968	avscan.exe	REG.exe
PID 4968 wrote to memory of 5024	4968	avscan.exe	REG.exe
PID 4428 wrote to memory of 2952	4428	hosts.exe	REG.exe
PID 4428 wrote to memory of 2952	4428	hosts.exe	REG.exe
PID 4428 wrote to memory of 2952	4428	hosts.exe	REG.exe
PID 4968 wrote to memory of 2360	4968	avscan.exe	REG.exe
PID 4968 wrote to memory of 2360	4968	avscan.exe	REG.exe
PID 4968 wrote to memory of 2360	4968	avscan.exe	REG.exe
PID 4428 wrote to memory of 3604	4428	hosts.exe	REG.exe
PID 4428 wrote to memory of 3604	4428	hosts.exe	REG.exe
PID 4428 wrote to memory of 3604	4428	hosts.exe	REG.exe
PID 4968 wrote to memory of 2932	4968	avscan.exe	REG.exe
PID 4968 wrote to memory of 2932	4968	avscan.exe	REG.exe
PID 4968 wrote to memory of 2932	4968	avscan.exe	REG.exe
PID 4428 wrote to memory of 2624	4428	hosts.exe	REG.exe
PID 4428 wrote to memory of 2624	4428	hosts.exe	REG.exe
PID 4428 wrote to memory of 2624	4428	hosts.exe	REG.exe
PID 4968 wrote to memory of 4500	4968	avscan.exe	REG.exe
PID 4968 wrote to memory of 4500	4968	avscan.exe	REG.exe
PID 4968 wrote to memory of 4500	4968	avscan.exe	REG.exe
PID 4428 wrote to memory of 1204	4428	hosts.exe	REG.exe
PID 4428 wrote to memory of 1204	4428	hosts.exe	REG.exe
PID 4428 wrote to memory of 1204	4428	hosts.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\522180e84817741a0c25656cf714d660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\522180e84817741a0c25656cf714d660_NeikiAnalytics.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
2⤵
- Modifies registry key
PID:1068

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4216

C:\windows\hosts.exe
C:\windows\hosts.exe
4⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4428

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
5⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4868

C:\windows\hosts.exe
C:\windows\hosts.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1672

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
6⤵
- Adds policy Run key to start application
PID:1956

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:2952

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:3604

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:2624

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:1204

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
4⤵
- Adds policy Run key to start application
PID:4740

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:5024

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:2360

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:2932

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:4500

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4588

C:\windows\hosts.exe
C:\windows\hosts.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:740

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
3⤵
- Adds policy Run key to start application
PID:4596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1304

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery