Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 22:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe
-
Size
89KB
-
MD5
0f546ffdd39724a5ead211aac9d513a0
-
SHA1
84364261a904e909be8ceb5ffe1955834ffeb9a5
-
SHA256
146c698259e2a4d34ba6df382404ef5f21e72f61bf327c166de0ba77866d65d3
-
SHA512
b57d8fb816cd0657ff1dc358186c8a2dcbcf0aff1bc5727d8e2a62c20e4e96483b4b7b9494b93843cceb2d8d8017b475b78bba2f92e99e7cfe8247765467d3bf
-
SSDEEP
1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnG:BDeb4T0daHy9DZc86yGUtnG
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe -
Executes dropped EXE 12 IoCs
pid Process 376 SVCHOST.EXE 2732 SVCHOST.EXE 2264 SVCHOST.EXE 3376 SVCHOST.EXE 1936 SVCHOST.EXE 3992 SPOOLSV.EXE 2432 SVCHOST.EXE 3848 SVCHOST.EXE 2652 SPOOLSV.EXE 4344 SPOOLSV.EXE 2828 SVCHOST.EXE 3788 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\M: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\I: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\N: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\S: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\J: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\H: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\P: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\W: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\K: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\V: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\Q: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\Z: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\Y: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\G: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\T: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\U: 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 30 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2736 WINWORD.EXE 2736 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 3992 SPOOLSV.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 376 SVCHOST.EXE 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE 2264 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 376 SVCHOST.EXE 2732 SVCHOST.EXE 2264 SVCHOST.EXE 3376 SVCHOST.EXE 1936 SVCHOST.EXE 3992 SPOOLSV.EXE 2432 SVCHOST.EXE 3848 SVCHOST.EXE 2652 SPOOLSV.EXE 4344 SPOOLSV.EXE 2828 SVCHOST.EXE 3788 SPOOLSV.EXE 2736 WINWORD.EXE 2736 WINWORD.EXE 2736 WINWORD.EXE 2736 WINWORD.EXE 2736 WINWORD.EXE 2736 WINWORD.EXE 2736 WINWORD.EXE -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 3452 wrote to memory of 376 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 83 PID 3452 wrote to memory of 376 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 83 PID 3452 wrote to memory of 376 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 83 PID 376 wrote to memory of 2732 376 SVCHOST.EXE 84 PID 376 wrote to memory of 2732 376 SVCHOST.EXE 84 PID 376 wrote to memory of 2732 376 SVCHOST.EXE 84 PID 376 wrote to memory of 2264 376 SVCHOST.EXE 85 PID 376 wrote to memory of 2264 376 SVCHOST.EXE 85 PID 376 wrote to memory of 2264 376 SVCHOST.EXE 85 PID 2264 wrote to memory of 3376 2264 SVCHOST.EXE 86 PID 2264 wrote to memory of 3376 2264 SVCHOST.EXE 86 PID 2264 wrote to memory of 3376 2264 SVCHOST.EXE 86 PID 2264 wrote to memory of 1936 2264 SVCHOST.EXE 87 PID 2264 wrote to memory of 1936 2264 SVCHOST.EXE 87 PID 2264 wrote to memory of 1936 2264 SVCHOST.EXE 87 PID 2264 wrote to memory of 3992 2264 SVCHOST.EXE 89 PID 2264 wrote to memory of 3992 2264 SVCHOST.EXE 89 PID 2264 wrote to memory of 3992 2264 SVCHOST.EXE 89 PID 3992 wrote to memory of 2432 3992 SPOOLSV.EXE 90 PID 3992 wrote to memory of 2432 3992 SPOOLSV.EXE 90 PID 3992 wrote to memory of 2432 3992 SPOOLSV.EXE 90 PID 3992 wrote to memory of 3848 3992 SPOOLSV.EXE 91 PID 3992 wrote to memory of 3848 3992 SPOOLSV.EXE 91 PID 3992 wrote to memory of 3848 3992 SPOOLSV.EXE 91 PID 3992 wrote to memory of 2652 3992 SPOOLSV.EXE 92 PID 3992 wrote to memory of 2652 3992 SPOOLSV.EXE 92 PID 3992 wrote to memory of 2652 3992 SPOOLSV.EXE 92 PID 376 wrote to memory of 4344 376 SVCHOST.EXE 93 PID 376 wrote to memory of 4344 376 SVCHOST.EXE 93 PID 376 wrote to memory of 4344 376 SVCHOST.EXE 93 PID 3452 wrote to memory of 2828 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 94 PID 3452 wrote to memory of 2828 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 94 PID 3452 wrote to memory of 2828 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 94 PID 3452 wrote to memory of 3788 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 95 PID 3452 wrote to memory of 3788 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 95 PID 3452 wrote to memory of 3788 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 95 PID 376 wrote to memory of 1504 376 SVCHOST.EXE 96 PID 376 wrote to memory of 1504 376 SVCHOST.EXE 96 PID 376 wrote to memory of 1504 376 SVCHOST.EXE 96 PID 1504 wrote to memory of 3736 1504 userinit.exe 97 PID 1504 wrote to memory of 3736 1504 userinit.exe 97 PID 3452 wrote to memory of 2736 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 98 PID 3452 wrote to memory of 2736 3452 0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:376 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3376
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1936
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2432
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3848
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4344
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE4⤵
- Modifies registry class
PID:3736
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2828
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3788
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0f546ffdd39724a5ead211aac9d513a0_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5755194182176a37ae78393ba401fa923
SHA128962ee666ed52c3787d35203cd5887363863905
SHA2563b4555049078f1c55ef78e46450d800c5b8b3c797288a9b725ec37ba1abef98a
SHA51281eac41625f673359d541909a3eea18b728ffd71bf08b4118cc300e19e71bba813762109ecd5b84947e31a490a2f77d566e16dc688c2ff22d81c9f6bcb4667ee
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
89KB
MD5d175093f331001363c7c94fd28b8f662
SHA1275be587ad9d55dc766a4d12c3d7db085e207a0b
SHA2567ee1ded5ff71dc471700e214545a6fd8983d482ef1700de8bbec16c474e654b0
SHA512df8670f45c9f3554cecc623b6fc2e26fa21fdadc9948a9a4a9a0c5ace1135068d74ac85c2b6585406156a79fab146fb9c5ddbcf7cf6f75f2b604b80269cf7b09
-
Filesize
89KB
MD5c4a893a27ad4c994a3878160c48d77c4
SHA19cd9bd8607f1dea4d99cdcb232be8230959ad1df
SHA2568dad2564556aa17d6bb9c02eeb1588961546783a57f23155eec91e6abae5ea49
SHA5123f76035f646e67b3736a54ac2fe747d812660837dc5f443d6f48d9cb5e7d13c848d2cb86bca294d166344866cea8f89737ee0bcd7abf042d6b195d0839ba5b1c