Analysis
-
max time kernel
121s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 11:17
Static task
static1
Behavioral task
behavioral1
Sample
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe
-
Size
100KB
-
MD5
4136eebfbb3da6e63c121a79ae08bce0
-
SHA1
145323565b7c6cdc68caf37478d6285c6825c048
-
SHA256
84018f158084ac8ef6ef3fe22bedcd3a38884c5f2be28f4d9cbef1d221956b79
-
SHA512
547dec952d9e4a0581971c882d7fbd19a967f4e6354e3ef7a1dc318bcabce4449a8cb4d7bb42aca9b0fed9cf45e78ac6fbabc5f9f95db17889d41849729f14db
-
SSDEEP
3072:SmITTTq1u+tsHalJRWA4qNWd/4h76koR:lIPu1jCalWA4DEXoR
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Processes:
resource yara_rule behavioral2/memory/3160-5-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-11-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-8-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-3-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-1-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-9-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-12-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-15-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-13-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-17-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-16-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-18-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-19-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-20-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-22-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-23-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-24-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-26-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-27-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-33-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-34-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-37-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-39-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-42-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-43-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-46-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-47-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-49-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-55-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-56-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-59-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-61-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-64-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-65-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-66-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-69-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-72-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-73-0x0000000002190000-0x000000000321E000-memory.dmp upx behavioral2/memory/3160-74-0x0000000002190000-0x000000000321E000-memory.dmp upx -
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process File opened (read-only) \??\L: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\N: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\P: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\U: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\V: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\W: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\G: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\I: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\J: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\K: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\R: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\S: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\T: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\E: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\O: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\X: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\Z: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\H: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\M: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\Q: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened (read-only) \??\Y: 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process File opened for modification C:\autorun.inf 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification F:\autorun.inf 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Drops file in Program Files directory 12 IoCs
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Drops file in Windows directory 1 IoCs
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exepid process 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription pid process Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Token: SeDebugPrivilege 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription pid process target process PID 3160 wrote to memory of 776 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe fontdrvhost.exe PID 3160 wrote to memory of 784 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe fontdrvhost.exe PID 3160 wrote to memory of 380 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe dwm.exe PID 3160 wrote to memory of 2744 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe sihost.exe PID 3160 wrote to memory of 2820 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe svchost.exe PID 3160 wrote to memory of 1432 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe taskhostw.exe PID 3160 wrote to memory of 3436 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Explorer.EXE PID 3160 wrote to memory of 3584 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe svchost.exe PID 3160 wrote to memory of 3764 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe DllHost.exe PID 3160 wrote to memory of 3852 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 3160 wrote to memory of 3916 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 4004 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe SearchApp.exe PID 3160 wrote to memory of 4152 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 5048 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe TextInputHost.exe PID 3160 wrote to memory of 4724 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 4600 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe backgroundTaskHost.exe PID 3160 wrote to memory of 776 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe fontdrvhost.exe PID 3160 wrote to memory of 784 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe fontdrvhost.exe PID 3160 wrote to memory of 380 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe dwm.exe PID 3160 wrote to memory of 2744 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe sihost.exe PID 3160 wrote to memory of 2820 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe svchost.exe PID 3160 wrote to memory of 1432 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe taskhostw.exe PID 3160 wrote to memory of 3436 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Explorer.EXE PID 3160 wrote to memory of 3584 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe svchost.exe PID 3160 wrote to memory of 3764 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe DllHost.exe PID 3160 wrote to memory of 3852 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 3160 wrote to memory of 3916 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 4004 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe SearchApp.exe PID 3160 wrote to memory of 4152 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 5048 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe TextInputHost.exe PID 3160 wrote to memory of 4724 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 1444 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 4912 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 776 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe fontdrvhost.exe PID 3160 wrote to memory of 784 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe fontdrvhost.exe PID 3160 wrote to memory of 380 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe dwm.exe PID 3160 wrote to memory of 2744 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe sihost.exe PID 3160 wrote to memory of 2820 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe svchost.exe PID 3160 wrote to memory of 1432 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe taskhostw.exe PID 3160 wrote to memory of 3436 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Explorer.EXE PID 3160 wrote to memory of 3584 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe svchost.exe PID 3160 wrote to memory of 3764 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe DllHost.exe PID 3160 wrote to memory of 3852 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 3160 wrote to memory of 3916 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 4004 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe SearchApp.exe PID 3160 wrote to memory of 4152 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 5048 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe TextInputHost.exe PID 3160 wrote to memory of 4724 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 1444 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 4912 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 776 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe fontdrvhost.exe PID 3160 wrote to memory of 784 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe fontdrvhost.exe PID 3160 wrote to memory of 380 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe dwm.exe PID 3160 wrote to memory of 2744 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe sihost.exe PID 3160 wrote to memory of 2820 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe svchost.exe PID 3160 wrote to memory of 1432 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe taskhostw.exe PID 3160 wrote to memory of 3436 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe Explorer.EXE PID 3160 wrote to memory of 3584 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe svchost.exe PID 3160 wrote to memory of 3764 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe DllHost.exe PID 3160 wrote to memory of 3852 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe StartMenuExperienceHost.exe PID 3160 wrote to memory of 3916 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 4004 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe SearchApp.exe PID 3160 wrote to memory of 4152 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe RuntimeBroker.exe PID 3160 wrote to memory of 5048 3160 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe TextInputHost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:380
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2820
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:1432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4136eebfbb3da6e63c121a79ae08bce0_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3584
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3764
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3916
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4152
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:5048
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4724
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4600
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1444
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4912
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\mhgk.exeFilesize
100KB
MD5e38551df4a546f15c266fed3aecc1bf0
SHA15da3913d4d5987a657c4fff2ba6248acdf5fce3d
SHA256a39f19ea81c324b321cdc9803dd091f137798fc907c66d8878f1759719a36706
SHA51211d9c301ff0e6c406dd262795804ec30701d84668a79a2dd18cb448dbc3a193d0f61b20c21d6d62f474110dc778a2b14b9452ebc23be13bf0a1012d2f04ed2da
-
memory/3160-0-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/3160-7-0x00000000039C0000-0x00000000039C1000-memory.dmpFilesize
4KB
-
memory/3160-5-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-11-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-8-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-3-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-10-0x0000000003970000-0x0000000003972000-memory.dmpFilesize
8KB
-
memory/3160-6-0x0000000003970000-0x0000000003972000-memory.dmpFilesize
8KB
-
memory/3160-1-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-9-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-14-0x0000000003970000-0x0000000003972000-memory.dmpFilesize
8KB
-
memory/3160-12-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-15-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-13-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-17-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-16-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-18-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-19-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-20-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-22-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-23-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-24-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-26-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-27-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-32-0x0000000004DA0000-0x0000000004DA2000-memory.dmpFilesize
8KB
-
memory/3160-31-0x0000000004DA0000-0x0000000004DA2000-memory.dmpFilesize
8KB
-
memory/3160-30-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/3160-33-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-34-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-37-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-39-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-42-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-43-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-46-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-47-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-49-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-55-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-56-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-59-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-61-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-64-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-65-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-66-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-67-0x0000000003970000-0x0000000003972000-memory.dmpFilesize
8KB
-
memory/3160-69-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-72-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-73-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-74-0x0000000002190000-0x000000000321E000-memory.dmpFilesize
16.6MB
-
memory/3160-75-0x0000000004DA0000-0x0000000004DA2000-memory.dmpFilesize
8KB