Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 05:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe
-
Size
97KB
-
MD5
1f3843f88caa7a73474063978aae0f70
-
SHA1
1d3196a876bb5879d9f3dea8f01c03680f2affda
-
SHA256
760b9382dd3a8add74ea80fe8f1157c59399e9521a19decd6b6c2589e2889c12
-
SHA512
b317da44f39eb292489c6c9e53f539fe1a547096c3ec03a59a8c252d6978cebb74711b66ef265ef9d31fa9775bb8fde4ea870db3081a52abc27159880213691d
-
SSDEEP
1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI4:J8dfX7y9DZ+N7eB+tI4
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe -
Executes dropped EXE 12 IoCs
pid Process 3456 SVCHOST.EXE 624 SVCHOST.EXE 4968 SVCHOST.EXE 2444 SVCHOST.EXE 1408 SVCHOST.EXE 4452 SPOOLSV.EXE 5072 SVCHOST.EXE 3300 SVCHOST.EXE 1112 SPOOLSV.EXE 2408 SPOOLSV.EXE 232 SVCHOST.EXE 2456 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\O: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\R: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\W: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\Z: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\I: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\V: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\X: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\G: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\N: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\P: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\Q: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\U: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\L: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\S: 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\QuickTip = "prop:Type;Size" 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\TileInfo = "prop:Type;Size" 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1508 WINWORD.EXE 1508 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3456 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 4968 SVCHOST.EXE 4968 SVCHOST.EXE 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 4968 SVCHOST.EXE 4968 SVCHOST.EXE 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 4968 SVCHOST.EXE 4968 SVCHOST.EXE 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 4968 SVCHOST.EXE 4968 SVCHOST.EXE 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 4968 SVCHOST.EXE 4968 SVCHOST.EXE 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 4968 SVCHOST.EXE 4968 SVCHOST.EXE 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 4452 SPOOLSV.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 4968 SVCHOST.EXE 4968 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 4968 SVCHOST.EXE 4968 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 4968 SVCHOST.EXE 4968 SVCHOST.EXE 3456 SVCHOST.EXE 3456 SVCHOST.EXE 4968 SVCHOST.EXE 4968 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 3456 SVCHOST.EXE 624 SVCHOST.EXE 4968 SVCHOST.EXE 2444 SVCHOST.EXE 1408 SVCHOST.EXE 4452 SPOOLSV.EXE 5072 SVCHOST.EXE 3300 SVCHOST.EXE 1112 SPOOLSV.EXE 2408 SPOOLSV.EXE 232 SVCHOST.EXE 2456 SPOOLSV.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE 1508 WINWORD.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1240 wrote to memory of 3456 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 83 PID 1240 wrote to memory of 3456 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 83 PID 1240 wrote to memory of 3456 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 83 PID 3456 wrote to memory of 624 3456 SVCHOST.EXE 84 PID 3456 wrote to memory of 624 3456 SVCHOST.EXE 84 PID 3456 wrote to memory of 624 3456 SVCHOST.EXE 84 PID 3456 wrote to memory of 4968 3456 SVCHOST.EXE 85 PID 3456 wrote to memory of 4968 3456 SVCHOST.EXE 85 PID 3456 wrote to memory of 4968 3456 SVCHOST.EXE 85 PID 4968 wrote to memory of 2444 4968 SVCHOST.EXE 86 PID 4968 wrote to memory of 2444 4968 SVCHOST.EXE 86 PID 4968 wrote to memory of 2444 4968 SVCHOST.EXE 86 PID 4968 wrote to memory of 1408 4968 SVCHOST.EXE 87 PID 4968 wrote to memory of 1408 4968 SVCHOST.EXE 87 PID 4968 wrote to memory of 1408 4968 SVCHOST.EXE 87 PID 4968 wrote to memory of 4452 4968 SVCHOST.EXE 88 PID 4968 wrote to memory of 4452 4968 SVCHOST.EXE 88 PID 4968 wrote to memory of 4452 4968 SVCHOST.EXE 88 PID 4452 wrote to memory of 5072 4452 SPOOLSV.EXE 90 PID 4452 wrote to memory of 5072 4452 SPOOLSV.EXE 90 PID 4452 wrote to memory of 5072 4452 SPOOLSV.EXE 90 PID 4452 wrote to memory of 3300 4452 SPOOLSV.EXE 91 PID 4452 wrote to memory of 3300 4452 SPOOLSV.EXE 91 PID 4452 wrote to memory of 3300 4452 SPOOLSV.EXE 91 PID 4452 wrote to memory of 1112 4452 SPOOLSV.EXE 92 PID 4452 wrote to memory of 1112 4452 SPOOLSV.EXE 92 PID 4452 wrote to memory of 1112 4452 SPOOLSV.EXE 92 PID 3456 wrote to memory of 2408 3456 SVCHOST.EXE 93 PID 3456 wrote to memory of 2408 3456 SVCHOST.EXE 93 PID 3456 wrote to memory of 2408 3456 SVCHOST.EXE 93 PID 1240 wrote to memory of 232 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 94 PID 1240 wrote to memory of 232 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 94 PID 1240 wrote to memory of 232 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 94 PID 1240 wrote to memory of 2456 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 95 PID 1240 wrote to memory of 2456 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 95 PID 1240 wrote to memory of 2456 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 95 PID 1240 wrote to memory of 1508 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 98 PID 1240 wrote to memory of 1508 1240 1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:624
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2444
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1408
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5072
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3300
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1112
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2408
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:232
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2456
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1f3843f88caa7a73474063978aae0f70_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5b043e7f49158395ae8adb8c97c25cf0b
SHA1ff8b119470ee39b51dbe7531228ad3887886b98e
SHA2562003d905e101f71f95747a722d195deaedef28e5f1786f13777d6f99046c8793
SHA5129e3ff28cafac5b2d78029c59c22da115e2ca4f8678e080cdfc52a14c9c2923d241affeea83a01d39cae41b9e31e0b761c63f94be59b1a63f88b1f8806981958c
-
Filesize
97KB
MD5d0ab932693fa1940d107236482a14fc9
SHA10e2d5cc556f89346313c215d31f33f2441ccee46
SHA2567e368261bf2cbd3942f6990d0b60187252ce546c60f0547bc95aabc9e16f1f1e
SHA51258fe279724dabdfa87ce5d7c52261af78766127bb6e12dd92d5aef4203aa467bfddacd5af44499613f7d776b3b75841ce18accaf2dfef4058ea4421c8974ed09
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
97KB
MD5ee9557c403b731913726f377e2e1d27b
SHA10d30dfa76e78dcf19fe29e41027c3dfdad4190f6
SHA2566390a457cc3c128a7f8eabb36fe9a09278bb40b7522c857d81f661ec8957636f
SHA512b88262e32f99f048b5424a4d42d6d4823ad3ac6ad0045e640e22dacc17ebd4188c4831b17f7e7bd893fea95ff8201a2a58f875974dff14a0921e5d12ba8b07df
-
Filesize
97KB
MD56c83c6a9983e25f66458b7816f2209c9
SHA1631e24f675caaeb24baab1d406ae3d17bebdfaa1
SHA2563973f02d909b787527ed2df457e578dfcaa68ac655e43254d40708a09fe72134
SHA5125e80f214e643330cd88f1153c6706a9130bce7058f2b2d5f7d3e1fe2a3f4d8ec26eba6764b85ee2dd48e03e3bf40270bb4b612945610d34db726423d1e6e013d
-
Filesize
97KB
MD525cada8aaf0545e9e54b7a2dd8758d86
SHA1f129f8a60a012fd4f8f66ad191d9264619f8e3c6
SHA2566c2ff351700225bfaffd83356c95e304cbfa2de0ec2116b1a5f1b8928e3ce62b
SHA512d1267513be5ba35b65cf7749541ff7489bce93fd0a39473773300cfb820f9aea26ebd078192fb71222c9491843d085e79072a384d947bdde59b47871b1917651
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
97KB
MD528d86ea377058470815655d2a81e70a0
SHA12b40152bc573689877588d89b8ea958052cf9061
SHA25662b2ae9586dc62a355d35bd2118c9cb2987fad99d68183ea797245d961af04bd
SHA512085fd760f49847c36d40dfc1c813749daa8f9605d13bfc87b350e4d019a4577e4a26fc11bff91cc62ddd6451ac582109e7855de9a12e30d848eb4d12de7371e9