Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 13:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe
- Size 89KB
- Sample240530-qa5deshe5s
- SHA256 79db5ee51b3e04f6d56b27a9305c39331e803e363994b0ab6ed64b0e1aa4701c
- MD5 6e69ce42995c67a7d08e5beb171a0b60
- SHA1 92ef26c42433f3360a00dfaddebb88f8d5f883ec
- SHA512 1a1043d69c51a8c9408f57bde5017bf4a6cb14849a6a534d42b497a212f50c7358847bea8cccd7224fa5a3294f5f9ecd11f87186c80d0cf9174280bbf9d74ec0
- SSDEEP 1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnn:BDeb4T0daHy9DZc86yGUtnn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe - Executes dropped EXE 12 IoCs
pid Process 4804 SVCHOST.EXE 872 SVCHOST.EXE 2540 SVCHOST.EXE 2176 SVCHOST.EXE 3324 SVCHOST.EXE 1220 SPOOLSV.EXE 2868 SVCHOST.EXE 624 SVCHOST.EXE 5016 SPOOLSV.EXE 2116 SPOOLSV.EXE 3952 SVCHOST.EXE 2100 SPOOLSV.EXE - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened for modification F:\Recycled\desktop.ini 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\Q: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\L: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\O: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\V: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\S: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\Z: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\X: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\R: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\I: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\K: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\U: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\N: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\T: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\W: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\Y: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\G: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\M: 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE - Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings Explorer.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1444 WINWORD.EXE 1444 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 1220 SPOOLSV.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4804 SVCHOST.EXE 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE 2540 SVCHOST.EXE - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 4804 SVCHOST.EXE 872 SVCHOST.EXE 2540 SVCHOST.EXE 2176 SVCHOST.EXE 3324 SVCHOST.EXE 1220 SPOOLSV.EXE 2868 SVCHOST.EXE 624 SVCHOST.EXE 5016 SPOOLSV.EXE 2116 SPOOLSV.EXE 3952 SVCHOST.EXE 2100 SPOOLSV.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE 1444 WINWORD.EXE - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 4556 wrote to memory of 4804 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 81 PID 4556 wrote to memory of 4804 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 81 PID 4556 wrote to memory of 4804 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 81 PID 4804 wrote to memory of 872 4804 SVCHOST.EXE 83 PID 4804 wrote to memory of 872 4804 SVCHOST.EXE 83 PID 4804 wrote to memory of 872 4804 SVCHOST.EXE 83 PID 4804 wrote to memory of 2540 4804 SVCHOST.EXE 84 PID 4804 wrote to memory of 2540 4804 SVCHOST.EXE 84 PID 4804 wrote to memory of 2540 4804 SVCHOST.EXE 84 PID 2540 wrote to memory of 2176 2540 SVCHOST.EXE 85 PID 2540 wrote to memory of 2176 2540 SVCHOST.EXE 85 PID 2540 wrote to memory of 2176 2540 SVCHOST.EXE 85 PID 2540 wrote to memory of 3324 2540 SVCHOST.EXE 86 PID 2540 wrote to memory of 3324 2540 SVCHOST.EXE 86 PID 2540 wrote to memory of 3324 2540 SVCHOST.EXE 86 PID 2540 wrote to memory of 1220 2540 SVCHOST.EXE 87 PID 2540 wrote to memory of 1220 2540 SVCHOST.EXE 87 PID 2540 wrote to memory of 1220 2540 SVCHOST.EXE 87 PID 1220 wrote to memory of 2868 1220 SPOOLSV.EXE 88 PID 1220 wrote to memory of 2868 1220 SPOOLSV.EXE 88 PID 1220 wrote to memory of 2868 1220 SPOOLSV.EXE 88 PID 1220 wrote to memory of 624 1220 SPOOLSV.EXE 89 PID 1220 wrote to memory of 624 1220 SPOOLSV.EXE 89 PID 1220 wrote to memory of 624 1220 SPOOLSV.EXE 89 PID 1220 wrote to memory of 5016 1220 SPOOLSV.EXE 90 PID 1220 wrote to memory of 5016 1220 SPOOLSV.EXE 90 PID 1220 wrote to memory of 5016 1220 SPOOLSV.EXE 90 PID 4804 wrote to memory of 2116 4804 SVCHOST.EXE 91 PID 4804 wrote to memory of 2116 4804 SVCHOST.EXE 91 PID 4804 wrote to memory of 2116 4804 SVCHOST.EXE 91 PID 4556 wrote to memory of 3952 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 93 PID 4556 wrote to memory of 3952 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 93 PID 4556 wrote to memory of 3952 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 93 PID 4556 wrote to memory of 2100 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 94 PID 4556 wrote to memory of 2100 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 94 PID 4556 wrote to memory of 2100 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 94 PID 4804 wrote to memory of 3964 4804 SVCHOST.EXE 95 PID 4804 wrote to memory of 3964 4804 SVCHOST.EXE 95 PID 4804 wrote to memory of 3964 4804 SVCHOST.EXE 95 PID 3964 wrote to memory of 2704 3964 userinit.exe 96 PID 3964 wrote to memory of 2704 3964 userinit.exe 96 PID 4556 wrote to memory of 1444 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 97 PID 4556 wrote to memory of 1444 4556 6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:872
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2176
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3324
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2868
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:624
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5016
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2116
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE4⤵
- Modifies registry class
PID:2704
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3952
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2100
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6e69ce42995c67a7d08e5beb171a0b60_NeikiAnalytics.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recycled\SPOOLSV.EXE
- Size 89KB
- SHA256 4e198d138f28edd805a7d2e24636bce42b8c4e8b51013cdf89458b33d83b78bf
- MD5 dea7ac0928d76fe25df0d233cf9cfd42
- SHA1 d3dac7241dea3925948649c43b62d55eee1e32d5
- SHA512 3b43e6f6e304cda82824a4a11937e583d0fa2f9567a000ebd753b66fe6d1198fb2f65c928c22aa6571d8653036260a7dd15193c6cf08498a98d73f0c69dcc8d3
- SSDEEP 1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnX:BDeb4T0daHy9DZc86yGUtnX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Recycled\SVCHOST.EXE
- Size 89KB
- SHA256 bc1e863bde6f68e3611b74b76fea33ba81e988e0f13b040c223c6a89872ee258
- MD5 6c9c9f12535612eed119b5f8ed137457
- SHA1 d061c21b9411e3816fdf85387e4e05b62a278514
- SHA512 c161a2c17de9e25441cb87939be5319ed54d022307f883038c688f0629504f611c3921c51bcf14a34836819542b22d277fd12ff8b02cf6d9188ddef778775a84
- SSDEEP 1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnA:BDeb4T0daHy9DZc86yGUtnA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 1KB
- SHA256 68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
- MD5 0269b6347e473980c5378044ac67aa1f
- SHA1 c3334de50e320ad8bce8398acff95c363d039245
- SHA512 e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\TCD90E0.tmp\sist02.xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path F:\Recycled\SVCHOST.EXE
- Size 89KB
- SHA256 4c0e6bccea1b5b62dbd2fc88926496bdb61dfac85029393aa9c1db58279c04d4
- MD5 ebeaa8657231c2d1786e4f38c15948e3
- SHA1 097713cb6b55521ea5294f85adacfb84dc0afb84
- SHA512 129662542de922b3c9a67ff1fb305a73f0d76467c9e24fb8d8f005d2299996e8c3648455bcb9cf54c0f23929de62454169418959c182d5d8316dcb13621123d5
- SSDEEP 1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEnJ:BDeb4T0daHy9DZc86yGUtnJ
- MD5 SHA1 SHA512 SSDEEP