9adde015996141199f100d4601cc5be9765997170b9fcbb95a23e4b474a6ac30

Processes:

154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

Processes:

154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

WScript.exeWScript.exeWScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SPDOHFMA = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SPDOHFMA = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SPDOHFMA = "W_X_C.bat"	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.execmd.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

Processes:

avscan.exeavscan.exehosts.exeavscan.exehosts.exehosts.exe

pid process

1528 avscan.exe
4520 avscan.exe
2972 hosts.exe
2916 avscan.exe
2896 hosts.exe
464 hosts.exe

pid	process
1528	avscan.exe
4520	avscan.exe
2972	hosts.exe
2916	avscan.exe
2896	hosts.exe
464	hosts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

hosts.exe154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exeavscan.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe

Drops file in Windows directory 5 IoCs

Processes:

154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exeavscan.exehosts.exe

description	ioc	process
File created	C:\windows\W_X_C.vbs	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe
File created	\??\c:\windows\W_X_C.bat	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe
File opened for modification	C:\Windows\hosts.exe	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.execmd.execmd.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

pid process

5068 REG.exe
3828 REG.exe
1232 REG.exe
3332 REG.exe
4208 REG.exe
1424 REG.exe
1568 REG.exe
5004 REG.exe
852 REG.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

avscan.exehosts.exe

pid process

1528 avscan.exe
2972 hosts.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exeavscan.exeavscan.exehosts.exeavscan.exehosts.exehosts.exe

pid process

3764 154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe
1528 avscan.exe
4520 avscan.exe
2972 hosts.exe
2916 avscan.exe
2896 hosts.exe
464 hosts.exe

pid	process
5068	REG.exe
3828	REG.exe
1232	REG.exe
3332	REG.exe
4208	REG.exe
1424	REG.exe
1568	REG.exe
5004	REG.exe
852	REG.exe

pid	process
1528	avscan.exe
2972	hosts.exe

pid	process
3764	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe
1528	avscan.exe
4520	avscan.exe
2972	hosts.exe
2916	avscan.exe
2896	hosts.exe
464	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exeavscan.execmd.exehosts.execmd.execmd.exe

description	pid	process	target process
PID 3764 wrote to memory of 1424	3764	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe	REG.exe
PID 3764 wrote to memory of 1424	3764	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe	REG.exe
PID 3764 wrote to memory of 1424	3764	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe	REG.exe
PID 3764 wrote to memory of 1528	3764	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe	avscan.exe
PID 3764 wrote to memory of 1528	3764	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe	avscan.exe
PID 3764 wrote to memory of 1528	3764	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe	avscan.exe
PID 1528 wrote to memory of 4520	1528	avscan.exe	avscan.exe
PID 1528 wrote to memory of 4520	1528	avscan.exe	avscan.exe
PID 1528 wrote to memory of 4520	1528	avscan.exe	avscan.exe
PID 1528 wrote to memory of 1740	1528	avscan.exe	cmd.exe
PID 1528 wrote to memory of 1740	1528	avscan.exe	cmd.exe
PID 1528 wrote to memory of 1740	1528	avscan.exe	cmd.exe
PID 3764 wrote to memory of 3204	3764	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe	cmd.exe
PID 3764 wrote to memory of 3204	3764	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe	cmd.exe
PID 3764 wrote to memory of 3204	3764	154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe	cmd.exe
PID 1740 wrote to memory of 2972	1740	cmd.exe	hosts.exe
PID 1740 wrote to memory of 2972	1740	cmd.exe	hosts.exe
PID 1740 wrote to memory of 2972	1740	cmd.exe	hosts.exe
PID 2972 wrote to memory of 2916	2972	hosts.exe	avscan.exe
PID 2972 wrote to memory of 2916	2972	hosts.exe	avscan.exe
PID 2972 wrote to memory of 2916	2972	hosts.exe	avscan.exe
PID 1740 wrote to memory of 3352	1740	cmd.exe	WScript.exe
PID 1740 wrote to memory of 3352	1740	cmd.exe	WScript.exe
PID 1740 wrote to memory of 3352	1740	cmd.exe	WScript.exe
PID 3204 wrote to memory of 2896	3204	cmd.exe	hosts.exe
PID 3204 wrote to memory of 2896	3204	cmd.exe	hosts.exe
PID 3204 wrote to memory of 2896	3204	cmd.exe	hosts.exe
PID 2972 wrote to memory of 4812	2972	hosts.exe	cmd.exe
PID 2972 wrote to memory of 4812	2972	hosts.exe	cmd.exe
PID 2972 wrote to memory of 4812	2972	hosts.exe	cmd.exe
PID 4812 wrote to memory of 464	4812	cmd.exe	hosts.exe
PID 4812 wrote to memory of 464	4812	cmd.exe	hosts.exe
PID 4812 wrote to memory of 464	4812	cmd.exe	hosts.exe
PID 3204 wrote to memory of 852	3204	cmd.exe	WScript.exe
PID 3204 wrote to memory of 852	3204	cmd.exe	WScript.exe
PID 3204 wrote to memory of 852	3204	cmd.exe	WScript.exe
PID 4812 wrote to memory of 856	4812	cmd.exe	WScript.exe
PID 4812 wrote to memory of 856	4812	cmd.exe	WScript.exe
PID 4812 wrote to memory of 856	4812	cmd.exe	WScript.exe
PID 1528 wrote to memory of 5068	1528	avscan.exe	REG.exe
PID 1528 wrote to memory of 5068	1528	avscan.exe	REG.exe
PID 1528 wrote to memory of 5068	1528	avscan.exe	REG.exe
PID 2972 wrote to memory of 3828	2972	hosts.exe	REG.exe
PID 2972 wrote to memory of 3828	2972	hosts.exe	REG.exe
PID 2972 wrote to memory of 3828	2972	hosts.exe	REG.exe
PID 1528 wrote to memory of 1568	1528	avscan.exe	REG.exe
PID 1528 wrote to memory of 1568	1528	avscan.exe	REG.exe
PID 1528 wrote to memory of 1568	1528	avscan.exe	REG.exe
PID 2972 wrote to memory of 1232	2972	hosts.exe	REG.exe
PID 2972 wrote to memory of 1232	2972	hosts.exe	REG.exe
PID 2972 wrote to memory of 1232	2972	hosts.exe	REG.exe
PID 1528 wrote to memory of 3332	1528	avscan.exe	REG.exe
PID 1528 wrote to memory of 3332	1528	avscan.exe	REG.exe
PID 1528 wrote to memory of 3332	1528	avscan.exe	REG.exe
PID 2972 wrote to memory of 5004	2972	hosts.exe	REG.exe
PID 2972 wrote to memory of 5004	2972	hosts.exe	REG.exe
PID 2972 wrote to memory of 5004	2972	hosts.exe	REG.exe
PID 1528 wrote to memory of 852	1528	avscan.exe	REG.exe
PID 1528 wrote to memory of 852	1528	avscan.exe	REG.exe
PID 1528 wrote to memory of 852	1528	avscan.exe	REG.exe
PID 2972 wrote to memory of 4208	2972	hosts.exe	REG.exe
PID 2972 wrote to memory of 4208	2972	hosts.exe	REG.exe
PID 2972 wrote to memory of 4208	2972	hosts.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\154fdd8d7a5ead17e65368304bef4670_NeikiAnalytics.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
2⤵
- Modifies registry key
PID:1424

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4520

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1740

C:\windows\hosts.exe
C:\windows\hosts.exe
4⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
5⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4812

C:\windows\hosts.exe
C:\windows\hosts.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:464

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
6⤵
- Adds policy Run key to start application
PID:856

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:3828

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:1232

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:5004

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
5⤵
- Modifies registry key
PID:4208

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
4⤵
- Adds policy Run key to start application
PID:3352

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:5068

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:1568

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:3332

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3204

C:\windows\hosts.exe
C:\windows\hosts.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2896

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
3⤵
- Adds policy Run key to start application
PID:852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery