Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe
-
Size
97KB
-
MD5
1b2e6863d541a4c2a37e06818c529d40
-
SHA1
2800b6a11e190be6e5cb7822f58470ffc19d75d5
-
SHA256
8e4605ce9403ff902ebd6c92a15f2f15be46967c43217b4ee3c9021d826da3d3
-
SHA512
1534d59c08e4ee51337fab8c301d32d96dc82dd1e26513cba95446164cda4d3e158ce2df2b1200713040f5987cd48f88915fb73163bca540ae23a1018982b8e8
-
SSDEEP
1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIe:J8dfX7y9DZ+N7eB+tIe
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe -
Executes dropped EXE 15 IoCs
pid Process 4772 SVCHOST.EXE 3000 SVCHOST.EXE 2860 SVCHOST.EXE 4900 SVCHOST.EXE 1096 SVCHOST.EXE 216 SPOOLSV.EXE 3660 SVCHOST.EXE 4408 SVCHOST.EXE 2252 SPOOLSV.EXE 752 SPOOLSV.EXE 4560 SVCHOST.EXE 1648 SPOOLSV.EXE 1472 SVCHOST.EXE 2648 SVCHOST.EXE 4004 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\H: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\K: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\E: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\X: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\W: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\Z: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\R: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\U: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\T: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\Y: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\G: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\M: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\O: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\Q: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\I: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\L: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\V: 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\QuickTip = "prop:Type;Size" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\TileInfo = "prop:Type;Size" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3052 WINWORD.EXE 3052 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 216 SPOOLSV.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 2860 SVCHOST.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 2860 SVCHOST.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 2860 SVCHOST.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 2860 SVCHOST.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 2860 SVCHOST.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 2860 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 4772 SVCHOST.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 2860 SVCHOST.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 2860 SVCHOST.EXE 216 SPOOLSV.EXE 216 SPOOLSV.EXE 2860 SVCHOST.EXE 2860 SVCHOST.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3052 WINWORD.EXE 3052 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 4772 SVCHOST.EXE 3000 SVCHOST.EXE 2860 SVCHOST.EXE 4900 SVCHOST.EXE 1096 SVCHOST.EXE 216 SPOOLSV.EXE 3660 SVCHOST.EXE 4408 SVCHOST.EXE 2252 SPOOLSV.EXE 752 SPOOLSV.EXE 4560 SVCHOST.EXE 1648 SPOOLSV.EXE 1472 SVCHOST.EXE 2648 SVCHOST.EXE 4004 SPOOLSV.EXE 3052 WINWORD.EXE 3052 WINWORD.EXE 3052 WINWORD.EXE 3052 WINWORD.EXE 3052 WINWORD.EXE 3052 WINWORD.EXE 3052 WINWORD.EXE -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3868 wrote to memory of 4772 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 89 PID 3868 wrote to memory of 4772 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 89 PID 3868 wrote to memory of 4772 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 89 PID 4772 wrote to memory of 3000 4772 SVCHOST.EXE 90 PID 4772 wrote to memory of 3000 4772 SVCHOST.EXE 90 PID 4772 wrote to memory of 3000 4772 SVCHOST.EXE 90 PID 4772 wrote to memory of 2860 4772 SVCHOST.EXE 91 PID 4772 wrote to memory of 2860 4772 SVCHOST.EXE 91 PID 4772 wrote to memory of 2860 4772 SVCHOST.EXE 91 PID 2860 wrote to memory of 4900 2860 SVCHOST.EXE 92 PID 2860 wrote to memory of 4900 2860 SVCHOST.EXE 92 PID 2860 wrote to memory of 4900 2860 SVCHOST.EXE 92 PID 2860 wrote to memory of 1096 2860 SVCHOST.EXE 93 PID 2860 wrote to memory of 1096 2860 SVCHOST.EXE 93 PID 2860 wrote to memory of 1096 2860 SVCHOST.EXE 93 PID 2860 wrote to memory of 216 2860 SVCHOST.EXE 94 PID 2860 wrote to memory of 216 2860 SVCHOST.EXE 94 PID 2860 wrote to memory of 216 2860 SVCHOST.EXE 94 PID 216 wrote to memory of 3660 216 SPOOLSV.EXE 95 PID 216 wrote to memory of 3660 216 SPOOLSV.EXE 95 PID 216 wrote to memory of 3660 216 SPOOLSV.EXE 95 PID 216 wrote to memory of 4408 216 SPOOLSV.EXE 96 PID 216 wrote to memory of 4408 216 SPOOLSV.EXE 96 PID 216 wrote to memory of 4408 216 SPOOLSV.EXE 96 PID 216 wrote to memory of 2252 216 SPOOLSV.EXE 97 PID 216 wrote to memory of 2252 216 SPOOLSV.EXE 97 PID 216 wrote to memory of 2252 216 SPOOLSV.EXE 97 PID 4772 wrote to memory of 752 4772 SVCHOST.EXE 98 PID 4772 wrote to memory of 752 4772 SVCHOST.EXE 98 PID 4772 wrote to memory of 752 4772 SVCHOST.EXE 98 PID 3868 wrote to memory of 4560 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 99 PID 3868 wrote to memory of 4560 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 99 PID 3868 wrote to memory of 4560 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 99 PID 3868 wrote to memory of 1648 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 100 PID 3868 wrote to memory of 1648 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 100 PID 3868 wrote to memory of 1648 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 100 PID 3868 wrote to memory of 1472 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 101 PID 3868 wrote to memory of 1472 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 101 PID 3868 wrote to memory of 1472 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 101 PID 3868 wrote to memory of 2648 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 102 PID 3868 wrote to memory of 2648 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 102 PID 3868 wrote to memory of 2648 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 102 PID 3868 wrote to memory of 4004 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 103 PID 3868 wrote to memory of 4004 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 103 PID 3868 wrote to memory of 4004 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 103 PID 3868 wrote to memory of 3052 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 104 PID 3868 wrote to memory of 3052 3868 1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3000
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4900
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1096
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3660
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4408
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2252
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:752
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4560
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2648
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4004
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1b2e6863d541a4c2a37e06818c529d40_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵PID:3900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD55dc51e80ead84084984042dadd0343ce
SHA1af231df0ab7521b7f284c3df7505b03242fc66df
SHA2562d7ecc7f94751c2e87e0fa5f6d24f8c97284a788af64a89bbf07581a840f6f88
SHA512a99ce195c3b292bd9e9908544cd3a45bb3018305ebd7574aeb56abc7314465ee9913d51bf6dd6b150d48dcfdf2a56c451bcaa13c1dcf48711c82bbab93fa4991
-
Filesize
97KB
MD5fb759c328fc0d3dc417546948c5c63bc
SHA168940f7db16a58c972dd402a47cd40e1e70446a4
SHA2564a75c95a6609154023dbae2f75b612ac9606dec19c5d786553858ddd3a5e8f72
SHA512cba7c47c150bb14bac75f2dee6f5512e0b2f906741f2e74dbdbd36a1c5248c485e415022d2dc9867e923a708a6b374434a50a587d7de366f3511d367de74e27d
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
97KB
MD5ef8d710bbcdc4c01f008cb1cdf0ebe10
SHA1ad179a59ee5255c8594e39ab4c440aedaebc75d5
SHA256a1e8897676d0544187100531c9edf9a76083f9beeea7552cf938bc287b57d5e5
SHA51205608d46195c4dfb68e51dba51f693ed1a7da703364039e17e3ac0947b3a9345c510785873f9766edc7e85bed19011c55d313f3e489685d58438297e2c5ec7f3
-
Filesize
97KB
MD507d9e20b9dd9e07a67877d170ef843c9
SHA1233a1da14e5439fe4960b214361bf7b6d6d17eef
SHA2564e589ec831653b8266f7fed479509db427922a954f46fee8ef9b40645f8a9f3c
SHA512fa0ce234f8b49b2e5428737ebdd2c40c2fea5cc583ad912f359e87ead3e7cd4671d5e596109f5fff302b71a9d6489b0ff2e7609b73202d4538a32714d0cb6366
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
97KB
MD58448dc6cb863665d6cc9a9bc358242b8
SHA116529199dee55e944e19dfdab1512c99c861b1a5
SHA256df578bcb5e7fef87e3ff0a32335f2c405a15671f9d14f7d80df8d24dcd05b56a
SHA5127eebda1b4ee951cf6a2cfdaa57745fac4239032df75ea4a64b756d87ff1c121f43b69081f8ceb118b1cbdf9b11f0678d6c9379fd543535b47516280826a09ed3