86ee7e63999c135c0477f22f1bf2724dae3f6389393c8c5ebe1a26417bb3990b

Processes:

avscan.exehosts.exe71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hosts.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

Processes:

71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exeavscan.exehosts.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	avscan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hosts.exe

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

WScript.exeWScript.exeWScript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RHATQEDQ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RHATQEDQ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RHATQEDQ = "W_X_C.bat"	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.execmd.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 6 IoCs

Processes:

avscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid process

3440 avscan.exe
392 avscan.exe
4704 hosts.exe
2112 hosts.exe
2604 avscan.exe
1192 hosts.exe

pid	process
3440	avscan.exe
392	avscan.exe
4704	hosts.exe
2112	hosts.exe
2604	avscan.exe
1192	hosts.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

avscan.exehosts.exe71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	avscan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	hosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\avscan = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avscan.exe"	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe

Drops file in Windows directory 5 IoCs

Processes:

71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exeavscan.exehosts.exe

description	ioc	process
File opened for modification	C:\Windows\hosts.exe	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe
File opened for modification	C:\Windows\hosts.exe	avscan.exe
File opened for modification	C:\Windows\hosts.exe	hosts.exe
File created	C:\windows\W_X_C.vbs	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe
File created	\??\c:\windows\W_X_C.bat	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

cmd.execmd.exe71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

pid process

4500 REG.exe
2112 REG.exe
1948 REG.exe
4436 REG.exe
4024 REG.exe
4896 REG.exe
5104 REG.exe
1224 REG.exe
3356 REG.exe
Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

avscan.exehosts.exe

pid process

3440 avscan.exe
4704 hosts.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exeavscan.exeavscan.exehosts.exehosts.exeavscan.exehosts.exe

pid process

4504 71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe
3440 avscan.exe
392 avscan.exe
2112 hosts.exe
4704 hosts.exe
2604 avscan.exe
1192 hosts.exe

pid	process
4500	REG.exe
2112	REG.exe
1948	REG.exe
4436	REG.exe
4024	REG.exe
4896	REG.exe
5104	REG.exe
1224	REG.exe
3356	REG.exe

pid	process
3440	avscan.exe
4704	hosts.exe

pid	process
4504	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe
3440	avscan.exe
392	avscan.exe
2112	hosts.exe
4704	hosts.exe
2604	avscan.exe
1192	hosts.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exeavscan.execmd.execmd.exehosts.execmd.exe

description	pid	process	target process
PID 4504 wrote to memory of 4500	4504	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe	REG.exe
PID 4504 wrote to memory of 4500	4504	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe	REG.exe
PID 4504 wrote to memory of 4500	4504	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe	REG.exe
PID 4504 wrote to memory of 3440	4504	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe	avscan.exe
PID 4504 wrote to memory of 3440	4504	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe	avscan.exe
PID 4504 wrote to memory of 3440	4504	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe	avscan.exe
PID 3440 wrote to memory of 392	3440	avscan.exe	avscan.exe
PID 3440 wrote to memory of 392	3440	avscan.exe	avscan.exe
PID 3440 wrote to memory of 392	3440	avscan.exe	avscan.exe
PID 3440 wrote to memory of 3396	3440	avscan.exe	cmd.exe
PID 3440 wrote to memory of 3396	3440	avscan.exe	cmd.exe
PID 3440 wrote to memory of 3396	3440	avscan.exe	cmd.exe
PID 4504 wrote to memory of 4912	4504	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe	cmd.exe
PID 4504 wrote to memory of 4912	4504	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe	cmd.exe
PID 4504 wrote to memory of 4912	4504	71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe	cmd.exe
PID 4912 wrote to memory of 4704	4912	cmd.exe	hosts.exe
PID 4912 wrote to memory of 4704	4912	cmd.exe	hosts.exe
PID 4912 wrote to memory of 4704	4912	cmd.exe	hosts.exe
PID 3396 wrote to memory of 2112	3396	cmd.exe	hosts.exe
PID 3396 wrote to memory of 2112	3396	cmd.exe	hosts.exe
PID 3396 wrote to memory of 2112	3396	cmd.exe	hosts.exe
PID 4704 wrote to memory of 2604	4704	hosts.exe	avscan.exe
PID 4704 wrote to memory of 2604	4704	hosts.exe	avscan.exe
PID 4704 wrote to memory of 2604	4704	hosts.exe	avscan.exe
PID 3396 wrote to memory of 4728	3396	cmd.exe	WScript.exe
PID 3396 wrote to memory of 4728	3396	cmd.exe	WScript.exe
PID 3396 wrote to memory of 4728	3396	cmd.exe	WScript.exe
PID 4704 wrote to memory of 5092	4704	hosts.exe	cmd.exe
PID 4704 wrote to memory of 5092	4704	hosts.exe	cmd.exe
PID 4704 wrote to memory of 5092	4704	hosts.exe	cmd.exe
PID 4912 wrote to memory of 4100	4912	cmd.exe	WScript.exe
PID 4912 wrote to memory of 4100	4912	cmd.exe	WScript.exe
PID 4912 wrote to memory of 4100	4912	cmd.exe	WScript.exe
PID 5092 wrote to memory of 1192	5092	cmd.exe	hosts.exe
PID 5092 wrote to memory of 1192	5092	cmd.exe	hosts.exe
PID 5092 wrote to memory of 1192	5092	cmd.exe	hosts.exe
PID 5092 wrote to memory of 3108	5092	cmd.exe	WScript.exe
PID 5092 wrote to memory of 3108	5092	cmd.exe	WScript.exe
PID 5092 wrote to memory of 3108	5092	cmd.exe	WScript.exe
PID 3440 wrote to memory of 2112	3440	avscan.exe	REG.exe
PID 3440 wrote to memory of 2112	3440	avscan.exe	REG.exe
PID 3440 wrote to memory of 2112	3440	avscan.exe	REG.exe
PID 4704 wrote to memory of 1948	4704	hosts.exe	REG.exe
PID 4704 wrote to memory of 1948	4704	hosts.exe	REG.exe
PID 4704 wrote to memory of 1948	4704	hosts.exe	REG.exe
PID 3440 wrote to memory of 4436	3440	avscan.exe	REG.exe
PID 3440 wrote to memory of 4436	3440	avscan.exe	REG.exe
PID 3440 wrote to memory of 4436	3440	avscan.exe	REG.exe
PID 4704 wrote to memory of 4896	4704	hosts.exe	REG.exe
PID 4704 wrote to memory of 4896	4704	hosts.exe	REG.exe
PID 4704 wrote to memory of 4896	4704	hosts.exe	REG.exe
PID 3440 wrote to memory of 5104	3440	avscan.exe	REG.exe
PID 3440 wrote to memory of 5104	3440	avscan.exe	REG.exe
PID 3440 wrote to memory of 5104	3440	avscan.exe	REG.exe
PID 4704 wrote to memory of 4024	4704	hosts.exe	REG.exe
PID 4704 wrote to memory of 4024	4704	hosts.exe	REG.exe
PID 4704 wrote to memory of 4024	4704	hosts.exe	REG.exe
PID 3440 wrote to memory of 1224	3440	avscan.exe	REG.exe
PID 3440 wrote to memory of 1224	3440	avscan.exe	REG.exe
PID 3440 wrote to memory of 1224	3440	avscan.exe	REG.exe
PID 4704 wrote to memory of 3356	4704	hosts.exe	REG.exe
PID 4704 wrote to memory of 3356	4704	hosts.exe	REG.exe
PID 4704 wrote to memory of 3356	4704	hosts.exe	REG.exe

C:\Users\Admin\AppData\Local\Temp\71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\71b55f0558d85976a5293764cfd69b90_NeikiAnalytics.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
2⤵
- Modifies registry key
PID:4500

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3440

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3396

C:\windows\hosts.exe
C:\windows\hosts.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2112

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
4⤵
- Adds policy Run key to start application
PID:4728

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:2112

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:4436

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:5104

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
3⤵
- Modifies registry key
PID:1224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4912

C:\windows\hosts.exe
C:\windows\hosts.exe
3⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704

C:\Users\Admin\AppData\Local\Temp\avscan.exe
C:\Users\Admin\AppData\Local\Temp\avscan.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c c:\windows\W_X_C.bat
4⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5092

C:\windows\hosts.exe
C:\windows\hosts.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1192

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
5⤵
- Adds policy Run key to start application
PID:3108

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
4⤵
- Modifies registry key
PID:1948

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
4⤵
- Modifies registry key
PID:4896

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
4⤵
- Modifies registry key
PID:4024

C:\Windows\SysWOW64\REG.exe
REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f
4⤵
- Modifies registry key
PID:3356

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\W_X_C.vbs"
3⤵
- Adds policy Run key to start application
PID:4100

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery