Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe
- Size 89KB
- Sample240526-w2evqsfd3v
- SHA256 10a7d3830bdc2f0ad08495bac24aee99a77cb04dbadc07927215b2a9092d3bce
- MD5 fb66927d67d5af5a0d003c47f48d4850
- SHA1 e7e58dec4fb4ada86e26907ba6fe28f043d2122d
- SHA512 586c13a2672806bfaa5c8a2b364976b7cbd85cb5a79d584df237a10cf361a137b344af08df7dfcfe44b9d927bba712120d6825c04ed42a56eec13cd34a56293d
- SSDEEP 1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnR:BDeb4T0daHy9DZc86yGUtnR
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe - Executes dropped EXE 12 IoCs
pid Process 1956 SVCHOST.EXE 4804 SVCHOST.EXE 1792 SVCHOST.EXE 2052 SVCHOST.EXE 3956 SVCHOST.EXE 1560 SPOOLSV.EXE 3676 SVCHOST.EXE 4828 SVCHOST.EXE 3860 SPOOLSV.EXE 3724 SPOOLSV.EXE 4472 SVCHOST.EXE 4428 SPOOLSV.EXE - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification F:\Recycled\desktop.ini fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened for modification C:\Recycled\desktop.ini fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\V: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\X: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\R: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\Q: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\T: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\S: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\J: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\W: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Z: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\E: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\I: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\L: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe File opened (read-only) \??\M: fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\QuickTip = "prop:Type;Size" fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\InfoTip = "prop:Type;Write;Size" fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\TileInfo = "prop:Type;Size" fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4408 WINWORD.EXE 4408 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1560 SPOOLSV.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1792 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 1956 SVCHOST.EXE 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 1956 SVCHOST.EXE 1956 SVCHOST.EXE 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 1956 SVCHOST.EXE 1956 SVCHOST.EXE 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 1956 SVCHOST.EXE 1956 SVCHOST.EXE - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 1956 SVCHOST.EXE 4804 SVCHOST.EXE 1792 SVCHOST.EXE 2052 SVCHOST.EXE 3956 SVCHOST.EXE 1560 SPOOLSV.EXE 3676 SVCHOST.EXE 4828 SVCHOST.EXE 3860 SPOOLSV.EXE 3724 SPOOLSV.EXE 4472 SVCHOST.EXE 4428 SPOOLSV.EXE 4408 WINWORD.EXE 4408 WINWORD.EXE 4408 WINWORD.EXE 4408 WINWORD.EXE 4408 WINWORD.EXE 4408 WINWORD.EXE 4408 WINWORD.EXE - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 3332 wrote to memory of 1956 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 90 PID 3332 wrote to memory of 1956 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 90 PID 3332 wrote to memory of 1956 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 90 PID 1956 wrote to memory of 4804 1956 SVCHOST.EXE 91 PID 1956 wrote to memory of 4804 1956 SVCHOST.EXE 91 PID 1956 wrote to memory of 4804 1956 SVCHOST.EXE 91 PID 1956 wrote to memory of 1792 1956 SVCHOST.EXE 92 PID 1956 wrote to memory of 1792 1956 SVCHOST.EXE 92 PID 1956 wrote to memory of 1792 1956 SVCHOST.EXE 92 PID 1792 wrote to memory of 2052 1792 SVCHOST.EXE 93 PID 1792 wrote to memory of 2052 1792 SVCHOST.EXE 93 PID 1792 wrote to memory of 2052 1792 SVCHOST.EXE 93 PID 1792 wrote to memory of 3956 1792 SVCHOST.EXE 94 PID 1792 wrote to memory of 3956 1792 SVCHOST.EXE 94 PID 1792 wrote to memory of 3956 1792 SVCHOST.EXE 94 PID 1792 wrote to memory of 1560 1792 SVCHOST.EXE 95 PID 1792 wrote to memory of 1560 1792 SVCHOST.EXE 95 PID 1792 wrote to memory of 1560 1792 SVCHOST.EXE 95 PID 1560 wrote to memory of 3676 1560 SPOOLSV.EXE 96 PID 1560 wrote to memory of 3676 1560 SPOOLSV.EXE 96 PID 1560 wrote to memory of 3676 1560 SPOOLSV.EXE 96 PID 1560 wrote to memory of 4828 1560 SPOOLSV.EXE 97 PID 1560 wrote to memory of 4828 1560 SPOOLSV.EXE 97 PID 1560 wrote to memory of 4828 1560 SPOOLSV.EXE 97 PID 1560 wrote to memory of 3860 1560 SPOOLSV.EXE 98 PID 1560 wrote to memory of 3860 1560 SPOOLSV.EXE 98 PID 1560 wrote to memory of 3860 1560 SPOOLSV.EXE 98 PID 1956 wrote to memory of 3724 1956 SVCHOST.EXE 99 PID 1956 wrote to memory of 3724 1956 SVCHOST.EXE 99 PID 1956 wrote to memory of 3724 1956 SVCHOST.EXE 99 PID 3332 wrote to memory of 4472 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 100 PID 3332 wrote to memory of 4472 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 100 PID 3332 wrote to memory of 4472 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 100 PID 3332 wrote to memory of 4428 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 101 PID 3332 wrote to memory of 4428 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 101 PID 3332 wrote to memory of 4428 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 101 PID 1956 wrote to memory of 1104 1956 SVCHOST.EXE 102 PID 1956 wrote to memory of 1104 1956 SVCHOST.EXE 102 PID 1956 wrote to memory of 1104 1956 SVCHOST.EXE 102 PID 1104 wrote to memory of 4644 1104 userinit.exe 103 PID 1104 wrote to memory of 4644 1104 userinit.exe 103 PID 3332 wrote to memory of 4408 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 104 PID 3332 wrote to memory of 4408 3332 fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4804
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2052
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3956
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3676
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4828
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3860
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3724
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE4⤵
- Modifies registry class
PID:4644
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4472
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4428
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fb66927d67d5af5a0d003c47f48d4850_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:81⤵PID:3276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recycled\SPOOLSV.EXE
- Size 89KB
- SHA256 d473e8fe350a0b4af2b2bca869c6ab642686888d0949a28392170fd28b8eea50
- MD5 9e34db04011e7a7f5e0b412e37583ee1
- SHA1 549abfc6c9c74fd6f7c7d421e18145fe3794decd
- SHA512 9ec96879fede3bffbac021a5927a6897b3a7f22c611df151bdf6a1548a6275c7a1c4ec9d71ef3e829c9c3dcd293619692c27d580f8ccb9cade31dc08ac23b659
- SSDEEP 1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnO:BDeb4T0daHy9DZc86yGUtnO
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Recycled\SVCHOST.EXE
- Size 89KB
- SHA256 d540b02fd0f6015e6810118f72cc47f86cd2adc2d3e66e804ed66851d1f3ff8d
- MD5 04c944352f5ec1773702b9e8329cbfa3
- SHA1 e9baadbbef8ed6d72564838ae66ad930e22a12f1
- SHA512 5b597cbd5b98a332d88825ac2f94d0a6f094151b5cff7ab021cf39572e372c1c725d4268261e68bdc01104ca185e80375dbfc05e615bdb2389e1211495d89da3
- SSDEEP 1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnM:BDeb4T0daHy9DZc86yGUtnM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 1KB
- SHA256 68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
- MD5 0269b6347e473980c5378044ac67aa1f
- SHA1 c3334de50e320ad8bce8398acff95c363d039245
- SHA512 e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\TCD399A.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path F:\Recycled\SVCHOST.EXE
- Size 89KB
- SHA256 37d05c009a3663a76e27b1bc3bd0b650ce740e5b29d326213648b70df748f5c7
- MD5 105fa37d7c2e528a171d98b2e3205ae3
- SHA1 6d784302f2c4cabefa898157bb9712b4e352cf38
- SHA512 e5ce65f11f746c7b3d0fdc64814f40e2ebc0eb1bf0e8d5a12bd6dbee627a41108f213fe1b716646775dcc6e503051203d6e45d9f82690364e09b89d68313d5b3
- SSDEEP 1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEng:BDeb4T0daHy9DZc86yGUtng
- MD5 SHA1 SHA512 SSDEEP