Analysis
- max time kernel
38s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 01:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
24 signatures
150 seconds
General
- Target 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe
- Size 1.4MB
- Sample240526-bzdvfaaa7y
- SHA256 d64afa2c4338bfd2c4215193bde86d13e8736d1a77f2193e565e8f1876dfa9fe
- MD5 4a11f152922f2e209f5ca06ef741ef60
- SHA1 216a2ffbd516a5604718497a185343981f3c4a01
- SHA512 7dc13d3e601ac75ef9d58e01c910c1a5c0e30892e3fbb4049a9d6b34ce62e19afbfa45d0ac628a277d56c8c8690a3198630703ad1037c4b5568f75aa1affe175
- SSDEEP 24576:k5xolYQY6EOb7YU0uestsWNthL8qUym53WJN5y3Mk1XXRw6+sBkZGsiH6W:nYW0ueBWjBy53WJN5y3Mi+6l9F
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies firewall policy service 2 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" spoolsv.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" spoolsv.exe - Modifies Installed Components in the registry 2 TTPs 5 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe - Deletes itself 1 IoCs
pid Process 4464 spoolsv.exe - Executes dropped EXE 6 IoCs
pid Process 3240 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe 4508 icsys.icn.exe 4128 explorer.exe 4464 spoolsv.exe 4728 svchost.exe 640 spoolsv.exe -
resource yara_rule behavioral2/memory/1492-1-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/1492-3-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/1492-6-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/1492-15-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/1492-14-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/1492-9-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/1492-4-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/files/0x0007000000023453-22.dat upx behavioral2/memory/3240-25-0x0000000000400000-0x0000000000684000-memory.dmp upx behavioral2/memory/3240-24-0x0000000000400000-0x0000000000684000-memory.dmp upx behavioral2/memory/1492-23-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/1492-5-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/3240-27-0x0000000000400000-0x0000000000684000-memory.dmp upx behavioral2/memory/1492-17-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/1492-32-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/1492-39-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/1492-34-0x0000000002A00000-0x0000000003A8E000-memory.dmp upx behavioral2/memory/4464-67-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-65-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-68-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-80-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-92-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-91-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-87-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-86-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-88-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-98-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-100-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-102-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/4464-116-0x00000000029C0000-0x0000000003A4E000-memory.dmp upx behavioral2/memory/3240-151-0x0000000000400000-0x0000000000684000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" spoolsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" spoolsv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe - Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe File opened (read-only) \??\G: 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe File opened (read-only) \??\H: 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe File opened (read-only) \??\I: 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe File opened (read-only) \??\J: 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe File opened (read-only) \??\K: 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification \??\c:\windows\system\svchost.exe svchost.exe File opened for modification C:\Windows\SYSTEM.INI 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 4508 icsys.icn.exe 4508 icsys.icn.exe 4464 spoolsv.exe 4464 spoolsv.exe 4464 spoolsv.exe 4464 spoolsv.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4128 explorer.exe 4728 svchost.exe 4128 explorer.exe 4128 explorer.exe 4728 svchost.exe 4728 svchost.exe 4128 explorer.exe 4128 explorer.exe 4128 explorer.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4128 explorer.exe 4128 explorer.exe 4728 svchost.exe 4728 svchost.exe 4128 explorer.exe 4128 explorer.exe 4728 svchost.exe 4728 svchost.exe 4128 explorer.exe 4128 explorer.exe 4728 svchost.exe 4128 explorer.exe 4728 svchost.exe 4128 explorer.exe 4728 svchost.exe 4728 svchost.exe 4128 explorer.exe 4128 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4128 explorer.exe 4728 svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Token: SeDebugPrivilege 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 4508 icsys.icn.exe 4508 icsys.icn.exe 4128 explorer.exe 4128 explorer.exe 4464 spoolsv.exe 4464 spoolsv.exe 4728 svchost.exe 4728 svchost.exe 4128 explorer.exe 4128 explorer.exe 640 spoolsv.exe 640 spoolsv.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 792 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 9 PID 1492 wrote to memory of 800 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 10 PID 1492 wrote to memory of 64 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 13 PID 1492 wrote to memory of 2624 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 44 PID 1492 wrote to memory of 2656 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 45 PID 1492 wrote to memory of 2872 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 51 PID 1492 wrote to memory of 3512 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 56 PID 1492 wrote to memory of 3632 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 57 PID 1492 wrote to memory of 3824 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 58 PID 1492 wrote to memory of 3912 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 59 PID 1492 wrote to memory of 3976 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 60 PID 1492 wrote to memory of 4084 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 61 PID 1492 wrote to memory of 4136 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 62 PID 1492 wrote to memory of 1920 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 64 PID 1492 wrote to memory of 4496 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 75 PID 1492 wrote to memory of 344 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 82 PID 1492 wrote to memory of 916 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 84 PID 1492 wrote to memory of 3240 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 85 PID 1492 wrote to memory of 3240 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 85 PID 1492 wrote to memory of 3240 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 85 PID 1492 wrote to memory of 4508 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 86 PID 1492 wrote to memory of 4508 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 86 PID 1492 wrote to memory of 4508 1492 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe 86 PID 4508 wrote to memory of 4128 4508 icsys.icn.exe 87 PID 4508 wrote to memory of 4128 4508 icsys.icn.exe 87 PID 4508 wrote to memory of 4128 4508 icsys.icn.exe 87 PID 4128 wrote to memory of 4464 4128 explorer.exe 89 PID 4128 wrote to memory of 4464 4128 explorer.exe 89 PID 4128 wrote to memory of 4464 4128 explorer.exe 89 PID 4464 wrote to memory of 792 4464 spoolsv.exe 9 PID 4464 wrote to memory of 800 4464 spoolsv.exe 10 PID 4464 wrote to memory of 64 4464 spoolsv.exe 13 PID 4464 wrote to memory of 2624 4464 spoolsv.exe 44 PID 4464 wrote to memory of 2656 4464 spoolsv.exe 45 PID 4464 wrote to memory of 2872 4464 spoolsv.exe 51 PID 4464 wrote to memory of 3512 4464 spoolsv.exe 56 PID 4464 wrote to memory of 3632 4464 spoolsv.exe 57 PID 4464 wrote to memory of 3824 4464 spoolsv.exe 58 PID 4464 wrote to memory of 3912 4464 spoolsv.exe 59 PID 4464 wrote to memory of 3976 4464 spoolsv.exe 60 PID 4464 wrote to memory of 4084 4464 spoolsv.exe 61 PID 4464 wrote to memory of 4136 4464 spoolsv.exe 62 PID 4464 wrote to memory of 1920 4464 spoolsv.exe 64 PID 4464 wrote to memory of 4496 4464 spoolsv.exe 75 PID 4464 wrote to memory of 344 4464 spoolsv.exe 82 PID 4464 wrote to memory of 916 4464 spoolsv.exe 84 PID 4464 wrote to memory of 3240 4464 spoolsv.exe 85 PID 4464 wrote to memory of 3240 4464 spoolsv.exe 85 PID 4464 wrote to memory of 4508 4464 spoolsv.exe 86 PID 4464 wrote to memory of 4508 4464 spoolsv.exe 86 PID 4464 wrote to memory of 4128 4464 spoolsv.exe 87 PID 4464 wrote to memory of 4128 4464 spoolsv.exe 87 PID 4464 wrote to memory of 1476 4464 spoolsv.exe 88 PID 4464 wrote to memory of 4728 4464 spoolsv.exe 90 PID 4464 wrote to memory of 4728 4464 spoolsv.exe 90 PID 4464 wrote to memory of 4728 4464 spoolsv.exe 90 PID 4728 wrote to memory of 640 4728 svchost.exe 95 PID 4728 wrote to memory of 640 4728 svchost.exe 95 PID 4728 wrote to memory of 640 4728 svchost.exe 95 PID 4464 wrote to memory of 792 4464 spoolsv.exe 9 PID 4464 wrote to memory of 800 4464 spoolsv.exe 10 PID 4464 wrote to memory of 64 4464 spoolsv.exe 13 PID 4464 wrote to memory of 2624 4464 spoolsv.exe 44 PID 4464 wrote to memory of 2656 4464 spoolsv.exe 45 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" spoolsv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2656
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2872
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4a11f152922f2e209f5ca06ef741ef60_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1492 -
\??\c:\users\admin\appdata\local\temp\4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exec:\users\admin\appdata\local\temp\4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- System policy modification
PID:3240
-
-
C:\Users\Admin\AppData\Local\icsys.icn.exeC:\Users\Admin\AppData\Local\icsys.icn.exe3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4464 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:640
-
-
C:\Windows\SysWOW64\at.exeat 01:36 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe7⤵PID:2320
-
-
C:\Windows\SysWOW64\at.exeat 01:37 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe7⤵PID:3932
-
-
C:\Windows\SysWOW64\at.exeat 01:38 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe7⤵PID:3216
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3632
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3912
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3976
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4084
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4136
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1920
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4496
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:344
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:916
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:1476
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4700
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:2160
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\icsys.icn.exe
- Size 287KB
- SHA256 0f8b3c197b1526d4cf5dd77ac63749b4543e07b03d0b2decc66c9fb7128ccbaf
- MD5 4da835ed86a177928d6b289460782971
- SHA1 e15216b8987c45bb79cfaaa320e2beba6b00fa5f
- SHA512 c53ea9711409ae617fcb9dbf7a7543621128c4944771cdedb6d1b5604244f05adfd56ed29ba9f75ef6ad732cc8e33909242b726c184c70f5fd2ffab0f8f75543
- SSDEEP 6144:TvEa2U+T6i5LirrllHy4HUcMQY6Ou27Ox0+Mey5:TEaN+T5xYrllrU7QY6g7ObMb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 288KB
- SHA256 cc2d9e98e7781669e297d9e1b7cf55ecc6211c18c3158bfbdf497f758b18340f
- MD5 6b5c20af1557d271751f2654f200d74b
- SHA1 fa5ed5bd483a9d52aef56cc07b14b18339971d69
- SHA512 936e7a359506a30c7f717ba45d31cae2496ff4c3e5205a6acb864dd4c3c7b4184bdb135130e71dd949399bb6cb1a8587a544ff6119be4a507e583ad78f045836
- SSDEEP 6144:TvEa2U+T6i5LirrllHy4HUcMQY6Ou27Ox0+Meyo:TEaN+T5xYrllrU7QY6g7ObMu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 256B
- SHA256 cab5e5838b4a90a67520cbecb6cf1c57a77561fb03362013ceb0ccb6be815d8c
- MD5 5290394fa06b034842ec6376a90adfd4
- SHA1 1d7e3d666aa48a13b236ec38fe67cca77d2c814e
- SHA512 e43d7842e6fdbe2211d7c42dd20d355429e355b62ddc60583e3ad59e59a036e225f556388e7c591c31c9c2235618c5646392ac21a315c31054c7a5ef8e3aefd1
- MD5 SHA1 SHA512
- Path C:\Windows\System\explorer.exe
- Size 288KB
- SHA256 757cd35d15759e62c511b3c372860f036c6106fc41fee471bb118316ed883efc
- MD5 bb61cdd096f040900b6e4ccc5d93d2e6
- SHA1 4eeeb4d608283a92a9405395dc72af26ea59ee41
- SHA512 d29b2e1c4f700a3ba4323b52051e9811b446dcf40b31e26db87e65f5cada70be6ace997e94712f0c170de1ced64bc7288ad35ff615b05ffa2f7f73f2bc613f06
- SSDEEP 6144:TvEa2U+T6i5LirrllHy4HUcMQY6Ou27Ox0+Mey9:TEaN+T5xYrllrU7QY6g7ObMr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\defh.exe
- Size 100KB
- SHA256 f3caa9474af474db0d057723e184f2ceeeb78b1bcb10af6ae5faa0aae56c39c0
- MD5 822c0fca78ba5a7a794f559c8017d84e
- SHA1 c110c51445965fa00994d5a7dc0d250235117941
- SHA512 849e1f530b2705a60eba9e7f453bb4594db499dfe08c14d318626bcd10ba7f903be164cabb4d4ac835f9c6c2cf836f5c568b64be08b2c85f6d6af03d2d1506d9
- SSDEEP 1536:a266LogedzkWnre+7nuSfElLNdwzXoOa//OoHwIX+t0ejbelwvplwBoG:78Z5fOPqXvUwIX+t0e2lwvUB
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\users\admin\appdata\local\temp\4a11f152922f2e209f5ca06ef741ef60_neikianalytics.exe
- Size 1.1MB
- SHA256 52d50091fb9fdd697130aa261009e7cba56e3f0bae4771d791f3cf9e97cb3e22
- MD5 503004f1cf5c6785346e975a4e583cb7
- SHA1 074adca5b5260d05f31d948ed9c001bca0b64218
- SHA512 63bf68577e4c4cd6c5e688e66ec14a08a1e95c25e5a2c2ace35a6792b171b43025d59ca933c4ff12266b254995eca16c79a58043ceefdd747dc5004767104644
- SSDEEP 24576:8YU0uestsWNthL8qUym53WJN5y3Mk1XXRw6+sBkZGsiH6:m0ueBWjBy53WJN5y3Mi+6l9
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system\spoolsv.exe
- Size 287KB
- SHA256 0bf7350d88cb28fd8feb93d78a337e53fc6eab3a7a9a7af8b3d82a7cb5705d6f
- MD5 1d026797b77ff9dd7128889978451de6
- SHA1 540fdb46c28e0b67bdfa2a65eb07dd9432ca8350
- SHA512 614d81cffc1a07c10d1813e45cacd44ccd7711ffcfab1ec37ec9cbff2a79bf8c2b9446cdd7368ca24fac3e62f05166ccaf352ec906e5cd97d535b63e5972dde0
- SSDEEP 6144:TvEa2U+T6i5LirrllHy4HUcMQY6Ou27Ox0+MeyIAAAAAAAAAAAAAAAAAAAAAAAAt:TEaN+T5xYrllrU7QY6g7ObMu
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system\svchost.exe
- Size 287KB
- SHA256 f68c9f3a315e8f12e35dbfaf8233063ab5a355428bafab16902e9c9039390ac5
- MD5 15bb68ea1051b57e1f29c0ddecb47283
- SHA1 ed933171f8af166a4bd0dcff11091507c7b3dc18
- SHA512 0fca886b74f5f83b7e04ba2cb65b4a5587a2e541c9f16514ed387dc3045433018ba279614b3015039fe507702548f0d45ed35d6e8c357148947083c7c51d74aa
- SSDEEP 6144:TvEa2U+T6i5LirrllHy4HUcMQY6Ou27Ox0+MeyV:TEaN+T5xYrllrU7QY6g7ObMj
- MD5 SHA1 SHA512 SSDEEP