Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 22:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe
-
Size
97KB
-
MD5
9cbdc8a1671cdf70d5b0feb2370f1d40
-
SHA1
7798e12b4814cb52a0077ee1e532913951af74f0
-
SHA256
4160d4d66776f7383750b59ee8409ae5461921a6359378cbf992c21d46e7e802
-
SHA512
5ade2606be58512e16e55d44e8532112baf1ff2b20c6777e423980269435bfbf45df86450ebe7d8113385f0e723baba001bd27738bdbf686df39e5c2c1c46c85
-
SSDEEP
1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIn:J8dfX7y9DZ+N7eB+tIn
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe -
Executes dropped EXE 12 IoCs
pid Process 3280 SVCHOST.EXE 3412 SVCHOST.EXE 1988 SVCHOST.EXE 3512 SVCHOST.EXE 2816 SVCHOST.EXE 4860 SPOOLSV.EXE 4220 SVCHOST.EXE 4068 SVCHOST.EXE 3928 SPOOLSV.EXE 3720 SPOOLSV.EXE 4820 SVCHOST.EXE 3380 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\V: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\O: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\R: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\N: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\L: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\S: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\E: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\M: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\U: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\W: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\Z: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\Q: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\Y: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\G: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\I: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened (read-only) \??\J: 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4772 WINWORD.EXE 4772 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 3280 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE 1988 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 3280 SVCHOST.EXE 3412 SVCHOST.EXE 1988 SVCHOST.EXE 3512 SVCHOST.EXE 2816 SVCHOST.EXE 4860 SPOOLSV.EXE 4220 SVCHOST.EXE 4068 SVCHOST.EXE 3928 SPOOLSV.EXE 3720 SPOOLSV.EXE 4820 SVCHOST.EXE 3380 SPOOLSV.EXE 4772 WINWORD.EXE 4772 WINWORD.EXE 4772 WINWORD.EXE 4772 WINWORD.EXE 4772 WINWORD.EXE 4772 WINWORD.EXE 4772 WINWORD.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4564 wrote to memory of 3280 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 84 PID 4564 wrote to memory of 3280 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 84 PID 4564 wrote to memory of 3280 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 84 PID 3280 wrote to memory of 3412 3280 SVCHOST.EXE 85 PID 3280 wrote to memory of 3412 3280 SVCHOST.EXE 85 PID 3280 wrote to memory of 3412 3280 SVCHOST.EXE 85 PID 3280 wrote to memory of 1988 3280 SVCHOST.EXE 86 PID 3280 wrote to memory of 1988 3280 SVCHOST.EXE 86 PID 3280 wrote to memory of 1988 3280 SVCHOST.EXE 86 PID 1988 wrote to memory of 3512 1988 SVCHOST.EXE 87 PID 1988 wrote to memory of 3512 1988 SVCHOST.EXE 87 PID 1988 wrote to memory of 3512 1988 SVCHOST.EXE 87 PID 1988 wrote to memory of 2816 1988 SVCHOST.EXE 88 PID 1988 wrote to memory of 2816 1988 SVCHOST.EXE 88 PID 1988 wrote to memory of 2816 1988 SVCHOST.EXE 88 PID 1988 wrote to memory of 4860 1988 SVCHOST.EXE 89 PID 1988 wrote to memory of 4860 1988 SVCHOST.EXE 89 PID 1988 wrote to memory of 4860 1988 SVCHOST.EXE 89 PID 4860 wrote to memory of 4220 4860 SPOOLSV.EXE 90 PID 4860 wrote to memory of 4220 4860 SPOOLSV.EXE 90 PID 4860 wrote to memory of 4220 4860 SPOOLSV.EXE 90 PID 4860 wrote to memory of 4068 4860 SPOOLSV.EXE 91 PID 4860 wrote to memory of 4068 4860 SPOOLSV.EXE 91 PID 4860 wrote to memory of 4068 4860 SPOOLSV.EXE 91 PID 4860 wrote to memory of 3928 4860 SPOOLSV.EXE 92 PID 4860 wrote to memory of 3928 4860 SPOOLSV.EXE 92 PID 4860 wrote to memory of 3928 4860 SPOOLSV.EXE 92 PID 3280 wrote to memory of 3720 3280 SVCHOST.EXE 93 PID 3280 wrote to memory of 3720 3280 SVCHOST.EXE 93 PID 3280 wrote to memory of 3720 3280 SVCHOST.EXE 93 PID 4564 wrote to memory of 4820 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 95 PID 4564 wrote to memory of 4820 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 95 PID 4564 wrote to memory of 4820 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 95 PID 4564 wrote to memory of 3380 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 96 PID 4564 wrote to memory of 3380 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 96 PID 4564 wrote to memory of 3380 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 96 PID 4564 wrote to memory of 4772 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 98 PID 4564 wrote to memory of 4772 4564 9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3412
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3512
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4220
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4068
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3928
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3720
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4820
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3380
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9cbdc8a1671cdf70d5b0feb2370f1d40_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD51d35e000bcf177d9a5be0b78bf697eb2
SHA1bc4616cbc5302389fe3cbfd05dae45d1dfc9634e
SHA25606d3cf69145441816df7040a29c03bddd10635522dec9715e4a36bc61b5afe79
SHA512239a4fcfac2c363e4513e52e9d269529f258d638bed938198b6d63839a7bce5016b1cb0966664db7b4f56c04985cfea835f9dee0d162f4838b8aab61f9eaf99d
-
Filesize
97KB
MD5ca3877dd9618b32269ee75d699b8b3a8
SHA11061747c7ebca05d366cdcbd27fb04d333e63c3e
SHA2564b39d373221cd77425dc9d2397f3ceb7a0a0ff03c2b8ce9f6d571bac8a250733
SHA51262914272fb4d8753df3d4a13ab8d45c330fe53abf3f2caaf1b746648e797859467ff0a9e2c456462a0214b51ae5c21f2faab62bbe713a27e04fed0a339ec2c49
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
97KB
MD5e83faa8c48db666284f4884c5e0a61ae
SHA116df0f910cab188f1da6dc9c51ecaf0a30ff33a8
SHA25660a956219809317602269c55f45300d96cc79f41dfe4df2a88e243b781cc7178
SHA512055d3a5d0deb968c10826a7a24fc5c75901cd9870801dcb621baa94df48dea51a0d2f51706a1382e507c559ec8f01a2679fc2d5cf076b97128c111103c2646e5
-
Filesize
97KB
MD56013bcf3105931e895854fc2119ad621
SHA11f3da6db45d595a957fca6e7cbab82815e38330f
SHA256c77e8ca33d58992b94c92819144d56e2dbf255943d28a09cf05fffe6652c45e4
SHA512cc39d384df834a92eb29d83deead0ebf166875f1d264adab7262eb9fd4f8cbffff03c02053e25dc8ca45f086b94fccfdb234e9b3cb519263c1449d1058eea7f4
-
Filesize
97KB
MD5b46cd836c3b0bf5cbe7945ac13f42a85
SHA16f220de556a1e0c245a95f5f9dee3e1b4bd4e7e2
SHA256f91ade90afdec58973f611a25c463a3a340a4f7ef587e4777b4ebe617215138b
SHA51298fd68cb09a9c4a530199f9d960fc093f7f21a13aff3572c84ca33b08106ecf77d289318024c25f7f330dbbaf7c7680327db4abe35f77fb91cf35ad3f5a70c99
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
97KB
MD53889d2d9c586e2788a0c0c41ae4c7bca
SHA112fc7569d3111c52bd9e10e73dd62e92032befef
SHA256cac50a18dbbd16a16c667c5219bd117345a25e2839b987678386f82f54e1a577
SHA512f0320e3f1ecb91feca5185f1c736699ed5fdeacd7c6beb1a779f3cc8960ae57d92990f43c1be3491214f2482c1f416f2d2c7d9189abbe4c077578c516911416e