Analysis
- max time kernel
20s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 09:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
24 signatures
150 seconds
General
- Target 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe
- Size 292KB
- Sample240529-lyr1saag3t
- SHA256 bac724d6a090749660d5ed5b5694f9d989ec1d32fb9988d1f0798b6b38b50afe
- MD5 502245fea9ce9736de775c587cfc2eb0
- SHA1 bd5fceb952019c1ab15e90e2c0d6294eada8011f
- SHA512 0dd3afcb478f53ae24879418ab28b424e014b37ffc6f8e544fe62564189249e37f5514a98dff73c39f3100803a06a6cf54c3e8e36334990c9ac47ce7ec4f1245
- SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXETt:mEFN+T5xYrllrU7QY6wLkIo6A9t
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" svchost.exe - Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" explorer.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe - Modifies Installed Components in the registry 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" svchost.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} svchost.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999} svchost.exe - Deletes itself 1 IoCs
pid Process 3544 explorer.exe - Executes dropped EXE 4 IoCs
pid Process 3544 explorer.exe 2224 spoolsv.exe 1824 svchost.exe 1192 spoolsv.exe -
resource yara_rule behavioral2/memory/4376-3-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/4376-4-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/4376-9-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/4376-53-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/4376-17-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/4376-16-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/4376-10-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/4376-8-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/4376-5-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/4376-1-0x0000000002AD0000-0x0000000003B5E000-memory.dmp upx behavioral2/memory/3544-68-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-66-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-71-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-79-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-74-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-69-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-73-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-72-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-70-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-83-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-82-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-84-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-85-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-86-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-88-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-89-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-90-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-92-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-93-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-95-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-97-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-100-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-102-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-104-0x00000000035A0000-0x000000000462E000-memory.dmp upx behavioral2/memory/3544-105-0x00000000035A0000-0x000000000462E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" explorer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe - Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\G: explorer.exe File opened (read-only) \??\H: explorer.exe File opened (read-only) \??\I: explorer.exe File opened (read-only) \??\J: explorer.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\explorer.exe 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\svchost.exe svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 3544 explorer.exe 3544 explorer.exe 3544 explorer.exe 3544 explorer.exe 3544 explorer.exe 3544 explorer.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 3544 explorer.exe 3544 explorer.exe 1824 svchost.exe 1824 svchost.exe 3544 explorer.exe 3544 explorer.exe 1824 svchost.exe 1824 svchost.exe 3544 explorer.exe 3544 explorer.exe 1824 svchost.exe 1824 svchost.exe 3544 explorer.exe 3544 explorer.exe 1824 svchost.exe 1824 svchost.exe 3544 explorer.exe 3544 explorer.exe 1824 svchost.exe 1824 svchost.exe 3544 explorer.exe 1824 svchost.exe 3544 explorer.exe 1824 svchost.exe 3544 explorer.exe 3544 explorer.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 3544 explorer.exe 1824 svchost.exe 3544 explorer.exe 1824 svchost.exe 1824 svchost.exe 3544 explorer.exe 3544 explorer.exe 3544 explorer.exe 1824 svchost.exe 3544 explorer.exe 1824 svchost.exe 1824 svchost.exe 3544 explorer.exe 1824 svchost.exe 3544 explorer.exe 1824 svchost.exe 3544 explorer.exe 1824 svchost.exe 3544 explorer.exe 3544 explorer.exe 1824 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1824 svchost.exe 3544 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Token: SeDebugPrivilege 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 3544 explorer.exe 3544 explorer.exe 2224 spoolsv.exe 2224 spoolsv.exe 1824 svchost.exe 1824 svchost.exe 1192 spoolsv.exe 1192 spoolsv.exe 3544 explorer.exe 3544 explorer.exe - Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 4376 wrote to memory of 784 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 8 PID 4376 wrote to memory of 780 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 9 PID 4376 wrote to memory of 336 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 13 PID 4376 wrote to memory of 2708 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 51 PID 4376 wrote to memory of 3108 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 52 PID 4376 wrote to memory of 3160 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 53 PID 4376 wrote to memory of 3380 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 55 PID 4376 wrote to memory of 3552 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 57 PID 4376 wrote to memory of 3736 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 58 PID 4376 wrote to memory of 3840 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 59 PID 4376 wrote to memory of 3904 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 60 PID 4376 wrote to memory of 4020 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 61 PID 4376 wrote to memory of 3768 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 62 PID 4376 wrote to memory of 2476 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 74 PID 4376 wrote to memory of 3388 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 75 PID 4376 wrote to memory of 3912 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 81 PID 4376 wrote to memory of 3544 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 83 PID 4376 wrote to memory of 3544 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 83 PID 4376 wrote to memory of 3544 4376 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe 83 PID 3544 wrote to memory of 2224 3544 explorer.exe 84 PID 3544 wrote to memory of 2224 3544 explorer.exe 84 PID 3544 wrote to memory of 2224 3544 explorer.exe 84 PID 2224 wrote to memory of 1824 2224 spoolsv.exe 86 PID 2224 wrote to memory of 1824 2224 spoolsv.exe 86 PID 2224 wrote to memory of 1824 2224 spoolsv.exe 86 PID 1824 wrote to memory of 1192 1824 svchost.exe 87 PID 1824 wrote to memory of 1192 1824 svchost.exe 87 PID 1824 wrote to memory of 1192 1824 svchost.exe 87 PID 1824 wrote to memory of 4296 1824 svchost.exe 89 PID 1824 wrote to memory of 4296 1824 svchost.exe 89 PID 1824 wrote to memory of 4296 1824 svchost.exe 89 PID 3544 wrote to memory of 784 3544 explorer.exe 8 PID 3544 wrote to memory of 780 3544 explorer.exe 9 PID 3544 wrote to memory of 336 3544 explorer.exe 13 PID 3544 wrote to memory of 2708 3544 explorer.exe 51 PID 3544 wrote to memory of 3108 3544 explorer.exe 52 PID 3544 wrote to memory of 3160 3544 explorer.exe 53 PID 3544 wrote to memory of 3380 3544 explorer.exe 55 PID 3544 wrote to memory of 3552 3544 explorer.exe 57 PID 3544 wrote to memory of 3736 3544 explorer.exe 58 PID 3544 wrote to memory of 3840 3544 explorer.exe 59 PID 3544 wrote to memory of 3904 3544 explorer.exe 60 PID 3544 wrote to memory of 4020 3544 explorer.exe 61 PID 3544 wrote to memory of 3768 3544 explorer.exe 62 PID 3544 wrote to memory of 2476 3544 explorer.exe 74 PID 3544 wrote to memory of 3388 3544 explorer.exe 75 PID 3544 wrote to memory of 1824 3544 explorer.exe 86 PID 3544 wrote to memory of 1824 3544 explorer.exe 86 PID 3544 wrote to memory of 4588 3544 explorer.exe 88 PID 3544 wrote to memory of 3364 3544 explorer.exe 91 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" explorer.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:336
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2708
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3108
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\502245fea9ce9736de775c587cfc2eb0_NeikiAnalytics.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4376 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies visiblity of hidden/system files in Explorer
- UAC bypass
- Windows security bypass
- Modifies Installed Components in the registry
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3544 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe5⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe PR6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1192
-
-
C:\Windows\SysWOW64\at.exeat 09:58 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe6⤵PID:4296
-
-
C:\Windows\SysWOW64\at.exeat 09:59 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe6⤵PID:4480
-
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE4⤵PID:1716
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE4⤵PID:220
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3552
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3736
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3904
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4020
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3768
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2476
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3388
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3912
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4588
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3364
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:2656
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:2748
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\mrsys.exe
- Size 292KB
- SHA256 e16cc7a0a4d806e6895d514bddbca8d96b991c5e43478f9e9706a223868be013
- MD5 e9e3dbac552469735656950f71aadf1d
- SHA1 c615b8c1fa3143ce7665b32a1a0a1e9a018e99a5
- SHA512 56906f67a352b2b433864e9850f4344d39aad05ee2f5f11c41e8a4f88d52f6bfda5b2412afc41f9e165adb8a58a83e4ca83b63d50d8391f8e7dabefcc4d321d4
- SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXETH:mEFN+T5xYrllrU7QY6wLkIo6A9H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SYSTEM.INI
- Size 256B
- SHA256 be5dac8b813031446070e38691486608c05bd5f59348c8dd063db112e0656ea5
- MD5 54ae09ca39be4dcc30ac17689b737618
- SHA1 ef2380e499d5e23b482c15aa2b5c45a79b549f32
- SHA512 3896c1c1ed2208c89d9254b2e220b111bbee503fea500f90211926e32fc367bf927aa549c89deae0160b2d61ed18d20f76867276741243cb32fe7ea0c306870c
- MD5 SHA1 SHA512
- Path C:\Windows\System\spoolsv.exe
- Size 292KB
- SHA256 f9c69351708a1190c0a68802856cca4a513871bf6f32084f0f05ea68e205c726
- MD5 41c569729003ce4049cce9d13e637941
- SHA1 0d2f7cac23ba9c36444355e61bdd8b662c9e9aaf
- SHA512 b21ef0e52548dcafd29fab14f76394dc9f2c6c43ed451e75e8b8e949c38383042aba3266090850077827209d9c0353f7de29c6a36c56289f1881616b9b2458fb
- SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXET6:mEFN+T5xYrllrU7QY6wLkIo6A96
- MD5 SHA1 SHA512 SSDEEP
- Path C:\twjd.exe
- Size 100KB
- SHA256 9ab52a119d5a67b558d6fd58fa99f7b4bb192a4996cb67c255e29d21195bed28
- MD5 06e206f72f680dd26610ddd3ae5e8b6c
- SHA1 4149437de7a229bfd08d720c9a92a55e84fac19d
- SHA512 b252d0c25e0242ef254bf9228d5576a0bf2d0b2b22875f6fdde0a4fce50d4fb301bf8daf12211e4f177042a02556316111e9c1d426efb7e857cf25bcbe3d7d51
- SSDEEP 1536:uhqtSQyEIcwZgB9jkl6e+a0tpvfup1Zcm2ik5N9FLcH3VxllxsV5QsLDAuPX:/t7Uo4Mr/txulcm2T5Rw7w1v
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system\explorer.exe
- Size 292KB
- SHA256 f0a4825efdf360f62dab0a9622ee2adf17ae85d4c95b86e84fa02da77715d3ff
- MD5 e97445c3d7c0f64a672e1eba4c0c11a7
- SHA1 f7cf7edf4571744da1aca28cfcbc80cb3591aa77
- SHA512 b3a6edc3f858ff926fd284c9eababa0a9caeca5b6b71977dfa93d2cdcaca1ce3f4f880b053337862671d6277f6bee17f21c6169d664f72323493d3a15949b8ba
- SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXET4:mEFN+T5xYrllrU7QY6wLkIo6A94
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system\svchost.exe
- Size 292KB
- SHA256 778c22d0a90b1b215f7dc95011e76c04bfbe81f1ffc22d6d57b4f52932739534
- MD5 5d89f65bfca1605165089a1af82552c4
- SHA1 fcb77e8b7e788f6efcdb5f77bdb2777921098b24
- SHA512 481ad573cff61989474bfff58692e43d166ab8a2275b782b127051f7f9c5e07a9f7e244ac022ccd38fee0482a083e2ec8ee86e42621e0deae439ed15c778a249
- SSDEEP 6144:0vEF2U+T6i5LirrllHy4HUcMQY6wdgykIduVr/GASXETo:mEFN+T5xYrllrU7QY6wLkIo6A9o
- MD5 SHA1 SHA512 SSDEEP