Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe
-
Size
2.1MB
-
MD5
0f0cbb820e78029d86b8646df081f840
-
SHA1
deed7be3d6216dfb55e76cbed70755ac07ecbe32
-
SHA256
d1ff936ea7f9fb510c9fb5cbde514b1290f956c0913b604367c6a92427f2e137
-
SHA512
22e5447c135789172127129911c7fd3b305955d679bb22dca70cfca26b4811aa6afde9c00b15120254094f404fe12b32db4d93baf21675e67e3d2eb22052d18b
-
SSDEEP
49152:+8Y/4O8b8ITDnlaTeEXGF+6z8zmqtqCK3RTeyay+hviOZ8afQf2PynO:L2rw+6zEmqtqCKkT6OWO
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OneDriveSetupOneDrive = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftOneDriveSetup26962 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe" 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntdll.dll.dll 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\System32\DriverStore\FileRepository\remoteposdrv.inf_amd64_0f0da968c1cfce06\MicrosoftOperating.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\System32\DriverStore\FileRepository\1394.inf_amd64_a08737ea39f5790b\WindowsOperating.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe -
Drops file in Program Files directory 29 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\RCX52A7.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccmebasenonfipsInternet3.9.0.42221.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LibraryLink.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\RCX49AC.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX675E.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\WindowsTipRes.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\RCX49CC.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCX53B2.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\RCX5DB7.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\widevinecdmadapterdllInternational.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AcrobatAdobe.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX67DC.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\WindowsSystem10.0.19041.1.160101.0800.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\juschedChecker.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\widevinecdmadapterdllInternational.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\RCX5E35.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\RCX7078.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\WindowsSystem10.0.19041.1.160101.0800.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\RCX545F.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccmebasenonfipsInternet3.9.0.42221.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX5D58.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodAdobe.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\RCX492E.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\juschedChecker.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\StudioVSTOLoaderUI.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\mshwLatinWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\AdobeAcrobat19.10.20064.310990.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LibraryLink.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\AiodAiod.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-data-pdf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_00608074d7799e78\WindowsAPIs.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_system.data.datasetextensions.resources_b77a5c561934e089_4.0.15805.0_it-it_38244cfa51c0c7be\resourcesFramework.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\RCX12C5.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..lographicextensions_31bf3856ad364e35_10.0.19041.153_none_766dff58d5beafa2\OperatingMicrosoft10.0.19041.153.160101.0800.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\resourcesCmdlets.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\RCX1324.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\EngineMicrosoft.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g...scrptadm.resources_31bf3856ad364e35_10.0.19041.1_en-us_c085ed35d8405ce1\Microsoftscrptadm.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1_ar-sa_841b2dcf703e01c1\OperatingMicrosoft.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..em-config.resources_31bf3856ad364e35_10.0.19041.1_it-it_d45d039b342d94da\WindowsSERIALUI10.0.19041.1.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..xecutable.resources_31bf3856ad364e35_10.0.19041.1_it-it_abd67c7ccdb802a8\MicrosoftSistema.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-theme.resources_31bf3856ad364e35_10.0.19041.1_en-us_87edf218e14c1622\MicrosoftSystem.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alization.resources_31bf3856ad364e35_10.0.19041.1_en-us_a2708216c48a8e7e\ShapeCollectorSystem.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-tool-exe.resources_31bf3856ad364e35_10.0.19041.1_en-us_7322bfaaf0abd306\managebdeSystem.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\resourcesMicrosoft.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..chinese-tip_profile_31bf3856ad364e35_10.0.19041.1_none_8a2b738118073bce\WindowsImTCTip.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\SystemFramework.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speech-pal-desktop_31bf3856ad364e35_10.0.19041.1_none_407031515dcf23b3\SpeechWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_9972edde9b98690c\wscnotifywscproxystub.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft.data.entity.build.tasks_b03f5f7f11d50a3a_4.0.15805.0_none_e71d94ac8a46fb80\DataFramework.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoacquire_31bf3856ad364e35_10.0.19041.746_none_122faf636b919ad9\WindowsMicrosoft.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-agilevpn.resources_31bf3856ad364e35_10.0.19041.1_de-de_2c4b545e91e24985\Microsoftagilevpn10.0.19041.1.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\RCX9FC9.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\fr\InstallRegAsm.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_netfx-dfshim_dll_31bf3856ad364e35_10.0.19041.1_none_2e7103f3fc577168\dfshimWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\MicrosoftWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_es_31bf3856ad364e35\RCX1237.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nailcache.resources_31bf3856ad364e35_10.0.19041.1_de-de_e77ad07ed428e4bb\thumbcacheMicrosoft.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\IME\de-DE\BetriebssystemSpTip.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_ro-ro_1219f92ac5b548b0\SistemMicrosoft.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\msil_system.configuration.install.resources_b03f5f7f11d50a3a_10.0.19041.1_es-es_fb0bc56dbb59316a\FrameworkSystem2.0.50727.91496.0507279100.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\msil_multipoint-wms.dash..addintabs.resources_31bf3856ad364e35_10.0.19041.1_de-de_4dd6f8c60c2d41c0\resourcesWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\fr\RCXA037.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Boot\EFI\pt-PT\MicrosoftSistema.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Boot\EFI\pl-PL\memdiagbootmgr.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\IME\es-ES\RCX70BD.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\msil_microsoft.applicati..ulewizard.resources_31bf3856ad364e35_10.0.19041.1_es-es_5271e4fe1d5d533b\resourcesresources.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_es_31bf3856ad364e35\Sistemaresources.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andgroups.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_02b5417e30a372f0\WindowsMicrosoft10.0.19041.1.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..workspace.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_f0e5d0a35eb841a1\WindowsTSWORKSPACE.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\RCXE7A3.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\ja-JP\RCX2B93.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Boot\EFI\en-GB\bootmgrMicrosoft.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_93457fd8b57e67d8\OperatingSystem.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\IME\de-DE\RCX716B.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_nvdimm.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c7d40ebc419b9a8c\nvdimminfWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..sumercore.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_22073328270f03e3\dexploitationSystme.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\JA\SystemFramework.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\Framework64\WindowsSystem.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netjoin.resources_31bf3856ad364e35_10.0.19041.1_en-us_2d65915d710f1401\WindowsOperating.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..nter-shellproviders_31bf3856ad364e35_10.0.19041.1_none_4a5f2dd18f3a8deb\OperatingHCPROVIDERS.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\operativoresources10.0.19041.1.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..m-library.resources_31bf3856ad364e35_10.0.19041.1_it-it_35b543fa13574693\Sistemawpncore.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4f22230cd405bd67\SystemWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_windows-media-faceanalysis_31bf3856ad364e35_10.0.19041.264_none_6cee44dceaadd26a\FaceAnalysisWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..lprovider.resources_31bf3856ad364e35_10.0.19041.1_de-de_09b9ec0d5024b02e\WindowsWindows10.0.19041.1.160101.0800.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-winhvr_31bf3856ad364e35_10.0.19041.1_none_fc5d2e67adee5611\OperatingMicrosoft10.0.19041.1.160101.0800.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mirage_31bf3856ad364e35_10.0.19041.1_none_73e8d3cf733772c3\SystemMirage.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usbceip.resources_31bf3856ad364e35_10.0.19041.1_de-de_a8e73645cad53900\WindowsWindows10.0.19041.1.160101.0800.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Boot\Resources\fr-FR\Systmedexploitation.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..emotepage.resources_31bf3856ad364e35_10.0.19041.1_it-it_f9b36cc69b4dc165\remotepgremotepg.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapi2xclient.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_4bd70706bc3612d5\dexploitationWindows.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\RCX5986.tmp 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\3082\mscorsecrMicrosoft.exe 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe 2512 0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f0cbb820e78029d86b8646df081f840_NeikiAnalytics.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\RCX5DB7.tmp
Filesize2.1MB
MD52fd547c9cf2d40d018a85862b03787d7
SHA1272cd00736c86b6f67384550351d0ac492d5c639
SHA256eab3ed71528310a1e782f3a84ba60e3432f4228dbe7469061fe7fc0377749927
SHA512fb884300e29cf916ed1e24ed3287db46c51b4c4a5414fa5753bb6cbac85da960b92430678cfb5cb28d44528b96738b6a8874d726f97814c8d0b7808d8047c362
-
Filesize
2.1MB
MD5a639e151f96f002a1dd9133e69a4faf7
SHA191c3e84b73ab0abbbd36413aecbe2d1e7f9a458f
SHA2561881a538b211070882dbc44ffc26d1079a98c4278b73c5fdc9345abeb40acf45
SHA512a2006c7ed90cf508b5208a018f0c0cafed5fcf1e09d178a19e81bf506c16ba9405b195db92438a2d72a61d8c69eb87a5306fc130d6205ce083b9ff748a60ff44
-
Filesize
2.1MB
MD5be6fd460bfe6390297fbe18b10d04f07
SHA165121c2455d58fe5c2cbd9a5ac0a5d9a2d4fcead
SHA2564fc0118412b20d922db9c2fe0581f54632f380e16c1a2c47f4d462088e696d90
SHA5123204dee88bd117e736e9d15227aa4a396bf62e1dc0509818b200fd2e1a50c5bbc9a4757076e7af4d3805dc559c1867952220757203e6a1d0488be04fd37e85dc
-
Filesize
2.1MB
MD50f0cbb820e78029d86b8646df081f840
SHA1deed7be3d6216dfb55e76cbed70755ac07ecbe32
SHA256d1ff936ea7f9fb510c9fb5cbde514b1290f956c0913b604367c6a92427f2e137
SHA51222e5447c135789172127129911c7fd3b305955d679bb22dca70cfca26b4811aa6afde9c00b15120254094f404fe12b32db4d93baf21675e67e3d2eb22052d18b