b10f74ca3efab78100e75e3da642ba16700cae3803fdcada0da5afb2f77f0087

Analysis

max time kernel
136s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
Size

65KB
MD5

50bef715baa686ddabb4af77acc28710
SHA1

9463ed53aac856d15dba42c57dc2cb1feb4767c1
SHA256

b10f74ca3efab78100e75e3da642ba16700cae3803fdcada0da5afb2f77f0087
SHA512

38a50f69c95ee082479d274846506c009fc8864ba44d3cd3f7cad70ce7cd11ee3f235d293a6c3245a4c57d2a058c2c9f147c59f3fed7c11f1e97f0395dc08c5d
SSDEEP

1536:prayLgKh8/HIYNcn0HUcrPyzVmgXolgE+GIbIi9MEd7wVyxXX7G:3kKh8/HIYNc0NTyzV9wf+GIUi72yx

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe:*:enabled:@shell32.dll,-1"	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2792	5056	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 620	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	5
PID 5056 wrote to memory of 620	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	5
PID 5056 wrote to memory of 620	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	5
PID 5056 wrote to memory of 620	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	5
PID 5056 wrote to memory of 620	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	5
PID 5056 wrote to memory of 620	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	5
PID 5056 wrote to memory of 672	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	7
PID 5056 wrote to memory of 672	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	7
PID 5056 wrote to memory of 672	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	7
PID 5056 wrote to memory of 672	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	7
PID 5056 wrote to memory of 672	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	7
PID 5056 wrote to memory of 672	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	7
PID 5056 wrote to memory of 776	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	8
PID 5056 wrote to memory of 776	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	8
PID 5056 wrote to memory of 776	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	8
PID 5056 wrote to memory of 776	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	8
PID 5056 wrote to memory of 776	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	8
PID 5056 wrote to memory of 776	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	8
PID 5056 wrote to memory of 784	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	9
PID 5056 wrote to memory of 784	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	9
PID 5056 wrote to memory of 784	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	9
PID 5056 wrote to memory of 784	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	9
PID 5056 wrote to memory of 784	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	9
PID 5056 wrote to memory of 784	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	9
PID 5056 wrote to memory of 792	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	10
PID 5056 wrote to memory of 792	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	10
PID 5056 wrote to memory of 792	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	10
PID 5056 wrote to memory of 792	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	10
PID 5056 wrote to memory of 792	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	10
PID 5056 wrote to memory of 792	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	10
PID 5056 wrote to memory of 900	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	11
PID 5056 wrote to memory of 900	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	11
PID 5056 wrote to memory of 900	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	11
PID 5056 wrote to memory of 900	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	11
PID 5056 wrote to memory of 900	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	11
PID 5056 wrote to memory of 900	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	11
PID 5056 wrote to memory of 944	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	12
PID 5056 wrote to memory of 944	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	12
PID 5056 wrote to memory of 944	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	12
PID 5056 wrote to memory of 944	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	12
PID 5056 wrote to memory of 944	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	12
PID 5056 wrote to memory of 944	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	12
PID 5056 wrote to memory of 1020	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	13
PID 5056 wrote to memory of 1020	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	13
PID 5056 wrote to memory of 1020	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	13
PID 5056 wrote to memory of 1020	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	13
PID 5056 wrote to memory of 1020	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	13
PID 5056 wrote to memory of 1020	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	13
PID 5056 wrote to memory of 520	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	14
PID 5056 wrote to memory of 520	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	14
PID 5056 wrote to memory of 520	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	14
PID 5056 wrote to memory of 520	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	14
PID 5056 wrote to memory of 520	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	14
PID 5056 wrote to memory of 520	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	14
PID 5056 wrote to memory of 864	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	15
PID 5056 wrote to memory of 864	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	15
PID 5056 wrote to memory of 864	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	15
PID 5056 wrote to memory of 864	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	15
PID 5056 wrote to memory of 864	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	15
PID 5056 wrote to memory of 864	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	15
PID 5056 wrote to memory of 996	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	16
PID 5056 wrote to memory of 996	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	16
PID 5056 wrote to memory of 996	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	16
PID 5056 wrote to memory of 996	5056	50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe	16

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:792
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:776
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3220
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3864
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3988
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4052
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:688
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4120
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4376
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1776
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3984
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:3856
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:5108
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2120

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1096
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2900
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:4404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1400
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:2036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1668

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1892

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2828

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3452

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3556
- C:\Users\Admin\AppData\Local\Temp\50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\50bef715baa686ddabb4af77acc28710_NeikiAnalytics.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 1132
    3⤵
    - Program crash
    PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3144

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5056 -ip 5056
1⤵
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5056-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5056-1-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/5056-3-0x0000000076F13000-0x0000000076F14000-memory.dmp

Filesize
4KB

Download
memory/5056-2-0x0000000076F12000-0x0000000076F13000-memory.dmp

Filesize
4KB

Download
memory/5056-4-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/5056-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/5056-7-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download